Accuracy
How accurate is it, and how would you know?
Anyone can publish an accuracy percentage and nobody can check one. So there is not one here. Every answer is graded by what your own documents support, and the grade tells you exactly which answers to look at, which is the only form of the number you can actually use.
One 241-question assessment, graded. Two of them needed a person. Sample data: the company and its documents are invented.
most solid
Confirmed in your documents
A passage in your own documents says this, in words close enough that the draft is a restatement rather than an interpretation. The citation names the file and the page or section it sits on, and opens it.
Read it and move on. This is the bulk of a questionnaire.
168 of 241 in the sample
The question
Is customer data encrypted at rest using industry-standard algorithms (e.g., AES-256)?
Drafted answer
Yes. All customer data is encrypted at rest with AES-256. Encryption is applied at the storage layer across our production databases and object storage, and keys are managed by our cloud provider's key management service with annual rotation.
Drawn from
explicit
Answered “no” from your documents
Your documentation says you do not do this. That is a finished answer and a correct one. Nobody expects every control; they expect you to know which ones you have.
Check the wording reads the way you want it read on the other side. A documented no is worth more than a vague yes.
21 of 241 in the sample
The question
Do you hold a current ISO 27001 certification?
Drafted answer
No. Northwind Systems is not currently ISO 27001 certified. We hold a SOC 2 Type II report covering the Security and Availability trust services criteria.
A documented "no" is a finished answer, not a gap in the draft. Check the wording reads the way you want it read on the other side.
Drawn from
reused
Reused from your library
You approved this exact wording on an earlier questionnaire, so it was reused rather than written again. Nothing was regenerated and nothing drifted.
Nothing, unless the fact has changed. This is why the second questionnaire takes less of your time than the first.
39 of 241 in the sample
The question
Do you maintain a Business Continuity Plan (BCP) that is tested annually?
Drafted answer
Yes. Northwind Systems maintains a documented Business Continuity Plan covering our production environment and critical business functions. The plan is reviewed and tested at least annually, and the most recent test was completed in the current calendar year.
You approved this exact answer on a previous questionnaire, so it was reused rather than regenerated.
Drawn from
inferred
Implied, not stated
Your documents point at this without saying it. The draft is defensible and it is not quoted, which is exactly the sentence that gets a company in trouble with a customer.
Look at it. Cut the part that is inferred, or confirm it and it becomes a library answer for next time.
11 of 241 in the sample
The question
Do you perform application vulnerability assessments at least annually?
Drafted answer
Yes. Application vulnerability assessments are performed at least annually, and an independent penetration test is carried out each year by an external firm.
Your documents confirm annual assessments but never mention an external penetration test. That second sentence is an inference. Cut it or confirm it before sending.
Drawn from
needs you
Not in your documents
Nothing in your knowledge base covers it. The cell is left blank on purpose rather than filled with something plausible, because a plausible sentence in that gap is a false security representation to your customer.
Write it, or send that one question to whoever does know. They answer by email without an account, and it is saved.
2 of 241 in the sample
The question
Do you carry cyber liability insurance, and what is the coverage limit?
Drafted answer
Left blank, deliberately.
Nothing in the knowledge base covers insurance. Rather than guessing a number, this one is left for you. Or send it to whoever holds the policy, and their answer is saved for next time.
Drawn from
Nothing in the knowledge base covers this.
Why not a percentage
A number would hide the only distinction that matters.
“Our documents say we do not do this” and “our documents say nothing about this” are different situations with different work attached. One is a finished answer. The other needs somebody to go and find out. On a confidence scale both land somewhere in the middle and both end up in the same undifferentiated flagged pile, which is where the reviewer's afternoon goes.
Sorting by verdict instead means the queue is short and every item in it says what to do.