Capability template for sales
Buyer security questionnaire answers
When a buyer sends a security questionnaire, your sales owner gets a draft answer matrix: each question beside the evidence your security owner supplied, its date, its limits and a named reviewer, with stale, partial and unverifiable answers marked.
Listed under
Add it to a workflow in the Fully Powered Planner, beside the teams and roles that will run it. Book a fit call
The outcome
The questionnaire stops being a scramble across sales, security and IT. The sales owner has one matrix in which every question is either answered from evidence the security owner has already supplied, or marked with the reason it cannot yet be: the evidence is out of date, covers only part of the question, or does not exist.
A written policy is never treated as proof that the practice is in place. Where only a policy exists, the matrix says so. The draft answers use the security owner's approved wording and nothing else, so the people who verify them are checking sources, not rewriting prose.
Who starts the work, and when
The sales owner starts it the day a buyer's questionnaire arrives, or when a buyer asks follow-up questions on an earlier one. The security owner supplies the evidence and verifies every answer. Named reviewers, such as the IT lead for hosting and backups, confirm the answers in their area. Sales sends only the response the security owner has approved for disclosure.
What they supply
- The buyer's questions, as a file or a list with a reference number for each.
- An evidence register from the security owner: approved policies, configuration exports and test records, each with its scope, source date, limits and owner.
- The rules for this response: how old evidence may be, what may be shared with this buyer and on what terms, and who reviews each topic.
- Any earlier correspondence with this buyer that changes what was asked.
What comes out
One draft answer matrix. Each question carries a mark (supported, partial, stale or unverifiable), a draft answer in the security owner's own approved wording, the evidence behind it with its date and age, its limits, and a named reviewer. The matrix ends with the counts, the answers that need a disclosure decision, and the questions held for the security owner, each as a question for a named person.
It is a draft. It assesses no security control and claims no compliance, and it sends nothing.
An invented example
Illustrative example with invented data. The company, buyer, people, evidence and dates below are made up. They show the inputs a person supplies and the matrix that comes out.
What the person supplies
The company and the run. Larchfield Software, an invented 80-person software company. The sales owner is Alicia Ward. The security owner is Dana Kessler. The IT lead is Tomas Rehn. Buyer X sent an eight-question security questionnaire on 2 November 2026. The assistant is run on 10 November 2026, the as-of date.
The rules for this response. Policies, test records and certificates count as current for 12 months (not older than 10 November 2025). Configuration exports count as current for 90 days (not older than 12 August 2026). Reviewers: Tomas Rehn for encryption, backups and hosting; Dana Kessler for everything else. Reports and documents may be shared with a buyer only if Dana Kessler approves, and under a confidentiality agreement.
The buyer's questions (Ref, Question).
- Q1: Is customer data encrypted at rest?
- Q2: Is multi-factor authentication required for staff access to production systems?
- Q3: Is an independent penetration test carried out each year on all customer-facing components? Please attach the latest report.
- Q4: Do you have a documented incident response plan that has been exercised in the last 12 months?
- Q5: Do you hold SOC 2 Type II or ISO 27001 certification?
- Q6: How often is customer data backed up, and how long are backups kept?
- Q7: Do you assess subprocessors before use? Please list them.
- Q8: In which regions is customer data stored?
The evidence register (Evidence ID, Topic, Approved statement, Type, Scope, Source date, Limits, Owner).
- E1, Encryption, "Production database and file storage volumes are encrypted at rest with AES-256.", configuration export, production database and file storage, 2026-10-06, backups not covered by this export, Tomas Rehn.
- E2, Access control, "Multi-factor authentication is required for all staff accounts.", policy (access control policy v3), all staff accounts, 2026-02-14, states the requirement only, Dana Kessler.
- E3, Access control, "The identity provider enforces multi-factor authentication for the staff group.", configuration export, identity provider, 2026-06-20, none stated, Dana Kessler.
- E4, Testing, "An independent penetration test of the web application and the API was completed in March 2026.", test record (summary), web application and API, 2026-03-09, the mobile app and internal network were out of scope, Dana Kessler.
- E5, Incident response, "A documented incident response plan is maintained.", policy (incident response plan v2), whole company, 2025-08-21, no record of an exercise, Dana Kessler.
- E6, Backups, "Customer data is backed up daily and backups are kept for 35 days.", configuration export, backup service, 2026-09-30, restore testing not covered, Tomas Rehn.
- E7, Vendor management, "Subprocessors are assessed before use.", policy (vendor management policy), all subprocessors, 2026-04-02, no subprocessor list supplied, Dana Kessler.
- E8, Hosting, "Production customer data is stored in Region North only.", configuration export, hosting account, 2026-10-20, none stated, Tomas Rehn.
- E9, Data handling, "Customer data may be stored in Region North and Region South.", policy (data handling policy), whole company, 2026-01-15, none stated, Dana Kessler.
What comes out
BUYER SECURITY QUESTIONNAIRE ANSWERS: Buyer X, 8 questions
For: Alicia Ward (sales owner). Verified by: Dana Kessler (security owner). Questionnaire received 2 November 2026. As of 10 November 2026.
Freshness limits used: policies, test records and certificates not older than 10 November 2025; configuration exports not older than 12 August 2026.
Q1: Is customer data encrypted at rest?
Mark: Partial
Draft answer: Production database and file storage volumes are encrypted at rest with AES-256.
Evidence: E1, configuration export, 2026-10-06, 35 days old, in date.
Limits: backups are not covered by this export. The question asks about customer data, and backups hold customer data.
Reviewer: Tomas Rehn.
Q2: Is multi-factor authentication required for staff access to production systems?
Mark: Stale
Draft answer: Not drafted. The enforcement evidence is past its limit. Closest evidence for the reviewer: E2 ("Multi-factor authentication is required for all staff accounts.") and E3 ("The identity provider enforces multi-factor authentication for the staff group.").
Evidence: E3, configuration export, 2026-06-20, 143 days old, over the 90-day limit. E2, policy, 2026-02-14, 269 days old, in date.
Limits: E2 states the requirement only; E3 is the evidence that it is enforced, and it is out of date. The question says production systems; the register does not say whether the staff group covers them.
Reviewer: Dana Kessler.
Q3: Is an independent penetration test carried out each year on all customer-facing components? Please attach the latest report.
Mark: Partial
Draft answer: An independent penetration test of the web application and the API was completed in March 2026.
Evidence: E4, test record (summary), 2026-03-09, 246 days old, in date.
Limits: the mobile app and internal network were out of scope. The register has no evidence of an annual cycle.
Reviewer: Dana Kessler.
Q4: Do you have a documented incident response plan that has been exercised in the last 12 months?
Mark: Stale
Draft answer: Not drafted. The plan's source date is past the limit and no exercise is recorded. Closest evidence for the reviewer: E5 ("A documented incident response plan is maintained.").
Evidence: E5, policy (incident response plan v2), 2025-08-21, 446 days old, over the 12-month limit.
Limits: no record of an exercise.
Reviewer: Dana Kessler.
Q5: Do you hold SOC 2 Type II or ISO 27001 certification?
Mark: Unverifiable
Draft answer: Not drafted. No entry in the register concerns a certification.
Evidence: none.
Limits: nothing can be said about certification unless the security owner supplies a certificate or report.
Reviewer: Dana Kessler.
Q6: How often is customer data backed up, and how long are backups kept?
Mark: Supported
Draft answer: Customer data is backed up daily and backups are kept for 35 days.
Evidence: E6, configuration export, 2026-09-30, 41 days old, in date.
Limits: restore testing is not covered.
Reviewer: Tomas Rehn.
Q7: Do you assess subprocessors before use? Please list them.
Mark: Partial
Draft answer: Subprocessors are assessed before use.
Evidence: E7, policy (vendor management policy), 2026-04-02, 222 days old, in date.
Limits: policy only, with no record that assessments were carried out. No subprocessor list was supplied, so the list is not drafted.
Reviewer: Dana Kessler.
Q8: In which regions is customer data stored?
Mark: Unverifiable
Draft answer: Not drafted. Two entries disagree and the assistant does not choose between them.
Evidence: E8, configuration export, 2026-10-20, 21 days old, in date: "Production customer data is stored in Region North only." E9, policy, 2026-01-15, 299 days old, in date: "Customer data may be stored in Region North and Region South."
Limits: the entries conflict; the security owner decides which is right.
Reviewer: Tomas Rehn and Dana Kessler.
Counts: Supported 1 (Q6). Partial 3 (Q1, Q3, Q7). Stale 2 (Q2, Q4). Unverifiable 2 (Q5, Q8). Total 8 of 8 questions.
Disclosure decisions needed: Q3, the latest penetration test report is requested; Dana Kessler decides whether it is shared and on what terms. Q7, a list of subprocessors is requested; Dana Kessler decides whether it is shared and on what terms.
Held for the security owner: 7. 1. Tomas Rehn: is customer data in backups encrypted at rest, and can a configuration export show it for Q1? 2. Dana Kessler: can a current configuration export for the identity provider be supplied for Q2, and does the staff group cover production systems? 3. Dana Kessler: can the latest penetration test report be shared for Q3, and is there evidence of a yearly cycle and of the mobile app being tested? 4. Dana Kessler: is there a current incident response plan and a record of an exercise in the last 12 months for Q4? 5. Dana Kessler: is there a SOC 2 Type II or ISO 27001 certificate or report for Q5? 6. Dana Kessler: can a subprocessor list and assessment records be supplied for Q7? 7. Tomas Rehn and Dana Kessler: which of E8 and E9 is correct for Q8?
Every answer traces to the evidence register as supplied. This matrix assesses no control, claims no compliance and sends nothing. Alicia Ward sends only the response Dana Kessler has approved.
Where it fits
- Sales, where a stalled questionnaire holds up a deal that is otherwise ready.
- Information security, which owns the evidence and decides what a buyer may be told.
- Software and technology, where buyers send security questionnaires routinely before they sign.
- Finance and investment, where a software supplier's controls are examined before any data is shared.
- Healthcare, where buyers ask detailed questions of a software supplier that will touch their records.
- Growth & scaling, when questionnaires arrive faster than one security owner can answer them.
- Established businesses, when the evidence exists but is scattered across teams.
It is separate from bid-or-no-bid and RFP response plan, which decides whether to respond to a request and plans the whole response, and from sales proposal preparation, which drafts the proposal. This capability handles one part of either: the security questions.
What has to change for your company
Set how old each kind of evidence may be before it counts as stale. Decide who reviews which topic, and who may approve disclosure. Agree what may be shared with a buyer, for example summaries freely and reports only under a confidentiality agreement. Fix the column headings of your evidence register once and keep to them. Keep the register in one place the security owner maintains, since the matrix can only be as current as that register.
What has been checked
Fully Powered AI wrote this capability template. It was editorially reviewed on 10 November 2026. It was tried once on its invented example in Claude on 10 November 2026; the record of that run is published with it. It has not yet been tested in a client environment. It has not yet been tried as a packaged version in ChatGPT, Claude, Copilot or Gemini.
Testing in your environment means running it on a questionnaire you have already answered, with cases written in advance: a policy with no configuration evidence, an export past its age limit, a question with no evidence at all, two sources that disagree. The security owner checks every answer against its source before anyone relies on it. Pilot acceptance-test preparation sets those cases up.
The full capability template
Everything above is the outline. The complete capability template is the working version: the roles, the inputs, the procedure, the exceptions and stop conditions, the output format, the reviewer checklist, the acceptance tests, the instructions for an AI assistant and what to customize for your company. It comes with a download and the link to its folder in Fully Powered’s public repository.
Free with an account. Sign in by email: no password and no card.
Next step
Put this capability to work for your team: on your plan, or built with you in a sprint.
Build this in a sprint
In a sprint, Fully Powered adapts this capability template to your rules, proves it on your own work and puts it in the hands of the roles that own it.
Two ways to begin: