Skip to main content
SimpleAudit

Questionnaire Coverage Preview

Pick the questionnaire you were sent, answer eleven yes or no questions and see how many SimpleAudit would answer for you.

Tell us what you keep

Which questionnaire were you sent?
Do you have approved policies for information security, access control, acceptable use, code of conduct, security training, encryption, data classification, data retention, privacy and physical security?
Do you have approved policies for change management, vulnerability management, system monitoring, network security, risk assessment and vendor management?
Do you have approved policies for incident response, business continuity, disaster recovery, and backup and recovery?
Do you keep a list of your vendors with what each one handles, reviewed in the past year?
Do you keep an inventory of company laptops and devices showing encryption, screen lock and update status?
Do you keep per-person records of security training, background checks, confidentiality agreements and policy sign-off?
Have you run an access review in the past year?
Have you done a risk assessment in the past year?
Have you run and written up incident response, business continuity and disaster recovery exercises in the past year?
Do you have a business impact analysis showing which functions matter most and how long each can be down?
Do you already have a SOC 2 report?

Your coverage preview

SimpleAudit would answer 21 of 64 SIG Lite questions for you

  • 21 taken from your records
  • 0 quoted from your policy
  • 43 need you

Taken from your records

Filled in from your company profile and the registers SimpleAudit keeps for you, with the source named.

  • C.1 Dedicated security team
  • C.2 Security owner role
  • E.1 Background checks on personnel
  • E.4 Formal onboarding process
  • E.5 Formal offboarding process
  • F.1 Physical office
  • G.1 Backup restores tested
  • G.2 Backup frequency
  • G.3 Change approval process
  • H.1 Multi-factor authentication enforced
  • H.2 Identity provider
  • I.3 Source code repository
  • J.1 Incident response plan
  • K.1 Recovery time objective
  • K.2 Recovery point objective
  • K.3 Disaster recovery environment
  • M.1 Device management
  • N.3 Data encrypted in transit
  • N.4 Data encrypted at rest
  • P.3 Types of data processed
  • U.1 Cloud hosting providers

Quoted from your policy

Filled in from an approved policy, with the policy cited so the reviewer can check it.

  • None with these answers.

Needs you

SimpleAudit may draft a suggestion, labeled AI-suggested, for you to confirm or change. Once you confirm an answer it is saved and reused on your next questionnaire.

  • A.1 Annual risk assessment
  • A.2 Approved risk assessment policy
  • B.1 Approved information security policy
  • B.2 Approved acceptable use policy
  • B.3 Policy acknowledgements current
  • C.3 Named internal security contact
  • D.1 Device encryption enforced
  • D.2 Endpoint protection installed
  • D.3 Screen lock enforced
  • D.4 Automatic OS updates
  • E.2 Confidentiality agreements signed
  • E.3 Security training current
  • F.2 Own data center
  • G.4 Centralized logging
  • G.5 Log retention
  • G.6 Vulnerability scanning
  • H.3 Access reviews performed
  • H.4 Privileged access review cadence
  • H.5 Minimum password length
  • H.6 Unique user accounts
  • H.7 SAML single sign-on supported
  • I.1 Code review required
  • I.2 Production separated from development
  • J.2 Incident response plan tested
  • J.3 Breach notification window
  • J.4 Security breach in past 24 months
  • K.4 Business continuity plan tested
  • K.5 Business impact analysis
  • K.6 Disaster recovery runbook details
  • L.1 SOC 2 report available
  • L.2 SOC 2 report date
  • L.3 Annual penetration test
  • L.4 Last penetration test
  • L.5 Cyber insurance
  • N.1 Network firewall
  • N.2 Network IP ranges
  • P.1 Data processing agreement available
  • P.2 Data residency
  • P.4 Data deleted at contract end
  • T.1 Intrusion detection
  • T.2 Critical vulnerability fix window
  • U.2 Sub-processors
  • U.3 Sub-processor change notice
Next: Readiness score

Answer your next questionnaire with SimpleAudit

SimpleAudit would draft 21 of 64 answers from your records and policies and flag the other 43 for you, with the source shown on each.

Essentials answers questionnaires from your records for $199/mo billed annually, 7-day free trial.

Start free trial

The questionnaires this preview covers

Customers and prospects send security questionnaires before they sign, and most arrive in one of a few well-known formats. SimpleAudit recognizes these when you upload them:

  • SIG Lite. Shared Assessments' short standard questionnaire. What to upload: the Excel workbook you were sent, with its question sheet left as it is.
  • CAIQ v4. The Cloud Security Alliance's cloud security questionnaire. What to upload: the Excel workbook you were sent, with its columns left as they are.
  • VSAQ. Google's open vendor security questionnaire. What to upload: an Excel (.xlsx) export of the questionnaire.

Anything else works too: any CSV or XLSX with a question column. One question per row. Other columns are fine.

How the count works

SimpleAudit keeps a fixed list of the topics security questionnaires ask about, such as whether you enforce multi-factor authentication, whether you have an approved incident response policy, or when your last access review took place. For each topic it knows where the answer lives in your account.

For SIG Lite, every question number maps to one of those topics, so the preview counts real questions. For CAIQ v4 and VSAQ, SimpleAudit matches each question to a topic when you upload the file, so the preview counts topics instead. Your yes or no answers above tell the preview which records and policies you already keep, and each row lands in one of three groups:

  • Taken from your records. The answer comes from your company profile or from a register SimpleAudit keeps with you, such as your vendor list or device inventory. Some topics, like multi-factor authentication or encryption, are always answered from the company profile you fill in during setup.
  • Quoted from your policy. The answer comes from an approved policy, and the policy is cited next to it so the person reviewing your answers can check it.
  • Needs you. SimpleAudit has nothing to answer from yet, or the question asks for internal detail that is never filled in automatically, such as IP ranges or a named security contact.

What “Needs you” means

A question that needs you is not a dead end. SimpleAudit may draft a suggestion, clearly labeled AI-suggested, for you to confirm or change, and you approve the whole questionnaire before you download it. Once you confirm an answer, it is saved and reused on your next questionnaire, so the same question does not need you twice.

Answering yes to more of the questions above usually means fewer rows need you, because the answers then come from records and policies you already keep.

What happens with a real questionnaire

Upload the file you were sent. SimpleAudit reads the questions, fills in what it can from your records and approved policies, and shows you each answer with its source. You review the answers, confirm or change the ones that need you, and download the same workbook with the answers in place.

Plan limits

Essentials includes 2 security questionnaires a year. Pro includes unlimited questionnaires. The preview on this page is free and has no limit.

Questions about the coverage preview

Do I need to upload my questionnaire to use this preview?
No. The preview runs entirely in your browser from the list of topics SimpleAudit knows how to answer. Nothing you pick is uploaded, stored or sent anywhere, and there is no signup or email gate.
Does AI write the answers to my questionnaire?
Answers taken from your records or quoted from your policy come straight from that source, and each one names where it came from. Where SimpleAudit has nothing to go on, it may draft a suggestion labeled AI-suggested for you to confirm or change. You approve the whole questionnaire before you download it.
Why do CAIQ v4 and VSAQ show topics instead of questions?
SimpleAudit has a fixed question list for SIG Lite, so the preview can count its questions one by one. For CAIQ v4 and VSAQ it matches each question to a topic when you upload the file, so the preview counts the topics it can cover rather than individual questions.
What counts as taken from your records?
Your company profile, which you fill in during setup, and the registers SimpleAudit keeps with you: vendors, devices, people, access reviews, risk assessments, exercises, your business impact analysis and any SOC 2 report you already have.
How many questionnaires can I review with SimpleAudit?
Essentials includes 2 security questionnaires a year. Pro includes unlimited questionnaires.