Engagement 06
Customer Evidence Pack
Answer the security questionnaire once, properly, and stop re-answering it.
The situation
The security questionnaire has quietly become the longest step in a mid-market sales cycle. It arrives attached to a contract that is otherwise ready to sign, and it gets answered by whoever has capacity that week.
The cost is not the hours. It is that the answers differ between questionnaires, and a buyer comparing two of them finds the inconsistency before you do.
This is you if
- Security reviews are now the longest step in your sales cycle.
- Each questionnaire is answered from scratch by whoever is free, and the answers do not match.
- A customer is asking for SSDF or CMMC evidence and you are assembling it by hand.
How it runs
- Week 1
Establish what you actually do
Your controls as they run, not as a prior questionnaire described them. Where the honest answer is that you do not, it is recorded as a gap rather than written around.
- Weeks 2–3
Crosswalk once
Each control mapped to every framework that asks for it — SSDF, S2C2F, SLSA and CMMC as applicable — so one piece of evidence answers all of them.
- Weeks 3–4
Assemble the pack
A reusable answer set with evidence attached, structured so the next questionnaire is a retrieval rather than a project.
What you are left holding
- A crosswalk from what you actually do to SSDF, S2C2F, SLSA and CMMC as applicable
- Evidence assembled once and mapped to every framework that asks for it
- A reusable answer set for the questionnaires you keep receiving
- The honest gaps, listed, so you are not discovered rather than disclosed
What we need from you
- The last two or three questionnaires you were sent, especially the ones you struggled with.
- Access to the evidence itself — pipeline configuration, policies, logs — rather than to summaries of it.
- A named owner who will keep the pack current after we hand it over.
A fixed fee that assumes nothing about access is a guess. This is the list that keeps the price the price.
What this is not
- Not a certification. This prepares evidence; it issues no attestation and replaces no auditor.
- Not answers written to pass. Gaps are listed as gaps, because a buyer who finds one you concealed stops believing the rest.
What we can already show
560 controls across 24 frameworks are modeled, so one control answers every framework that asks for it.
Why people call about this one
Your customers are asking first
Enterprise buyers and regulators now require SBOMs, provenance and SSDF or CMMC evidence from suppliers. The questionnaire arrives attached to a contract that is otherwise ready to sign.
The demand lands hardest on mid-size vendors and defense subcontractors, who are least equipped to answer it
The shape of it
- Shape
- Three to four weeks, fixed fee
- Usually funded by
- Compliance · CISO
- Often leads to
- Toolchain Rationalization