Nothing reaches a prospect until someone who owns security has seen it.
If sales sent you this page, here’s the short version. Every answer shows the sentence it came from. Every new answer is signed off by a person you choose. Questions your documents can’t answer stay empty and go to an owner instead of being invented.
Where does each answer come from?
From your documents and your previously approved answers, and nowhere else. Every drafted row shows the document, the page and the exact sentence it relied on, highlighted. If no sentence supports an answer, there is no answer.
Is MFA enforced for all employee access to production systems and administrative consoles?
Yes. MFA is required for all employee access to production systems, the AWS console and our identity provider. The four engineers with production administrator rights must use hardware security keys; everyone else uses an authenticator app.
MFA is required for every employee account. Engineers with production administrator rights must use a hardware security key as their second factor. Authenticator apps are not accepted for administrator roles.
Employees authenticate to production systems through the company identity provider. Multi-factor authentication using an authenticator application is enforced for all employee access to production systems.
Who is accountable if sales sends a wrong answer?
The person you name, through Sign-off. You decide who owns what: encryption and infrastructure to your Head of Engineering, background checks to People Ops, contract terms to whoever signs the DPA.
Any row that isn’t already a house answer goes to its owner’s queue. Sales can’t send a questionnaire back while rows are still waiting.
Yes. Backups are encrypted with AES-256 and replicated daily to a separate AWS account in a second region (us-west-2).
Point-in-time recovery is enabled for all production databases. Nightly snapshots are encrypted with AES-256 and replicated to an isolated AWS account in us-west-2. Snapshot integrity is verified weekly.
Isn't review just a rubber stamp?
Most weeks, honestly, yes, and that’s how it should be. The reviewer doesn’t need to know the answers to 280 questions from memory. They read one answer and one highlighted sentence and decide whether the two match.
Most rows are house answers that were signed off months ago, so the queue is short. When it isn’t short, something changed: a policy, a new pen test, a question you’ve never seen. That’s exactly when you want a person looking.
What happens to questions our documents don't cover?
They become open rows. Firstpass leaves the cell empty, marks it, and sends it to whoever owns that section, with a due date taken from the questionnaire’s deadline. The draft goes back without those rows rather than with an invented answer.
When the owner writes and approves an answer, it becomes a house answer, so the same gap doesn’t open twice.
- 2.7OpenAre background checks performed on contractors with system access?Policy covers employees onlyDODana OkaforThu 15 Oct
- 2.12OpenWhat percentage of staff completed security training this year?No document states a rateDODana OkaforThu 15 Oct
- 7.11OpenAre audit logs retained for at least 12 months?Logging standard says 90 days; SOC 2 is silentPRPriya RamanThu 15 Oct
- 8.6OpenHow often do you test restoring from backup? Date of last test?No restore test is documentedPRPriya RamanThu 15 Oct
- 8.9OpenState RTO and RPO for each service tier.DR plan gives one RTO for all tiersPRPriya RamanThu 15 Oct
- 9.8OpenCan customer data be hosted in Canada?Not covered by the DPAMLMarcus LeeThu 15 Oct
- 10.4OpenWhat is your cyber insurance coverage limit?No insurance document on the ShelfMLMarcus LeeThu 15 Oct
What's a house answer?
An answer someone with authority approved. It’s stored with its wording, its sources, who approved it and when. When any future questionnaire asks the same thing, in any wording, Firstpass uses it word for word.
You stop contradicting yourself across prospects.
What if a policy changes?
When a document on the Shelf is replaced, every house answer that cites it goes back to its owner with the old and new sentence side by side. Answers don’t go stale quietly.
Can we see who changed what?
Every row keeps its history: drafted from which source, edited by whom, approved by whom, returned to which prospect on which date. Export it as CSV if an auditor or a customer’s lawyer ever asks.