Security questionnaires
Send questionnaires to vendors and answer the ones customers send you
Build questionnaires for your vendors, answer customer questionnaires from your control library, and have AI draft answers for you to review. Follow each questionnaire from one dashboard.
In short
Security questionnaires slow down enterprise sales, and you send just as many to your own suppliers. Certifyi handles both. Send your vendors questionnaires through the vendor portal, and answer customer questionnaires from your existing controls and evidence. AI drafts answers for you to review, and nothing is used until a person accepts it.
Building your own questionnaires
Use the builder to assess vendors, or to set a standard list of security questions for anyone you plan to share sensitive data with.
- Text, multiple-choice, scale and file-upload questions
- Required and optional fields
Answering customer questionnaires
When a customer sends you a security questionnaire, bring it into Certifyi and answer it from your control library. Questions are matched to your controls and evidence, and suggested answers wait for someone on your team to review them.
Answers come from the controls you run today rather than last year’s spreadsheet.
Assessing your vendors
Send questionnaires to vendors through the vendor portal. Vendors answer, upload supporting evidence and submit, and their responses feed the vendor risk assessment.
Plan how often each tier of vendor is reassessed, so vendor risk is reviewed regularly rather than once at onboarding.
- Vendor portal
- Vendors answer questionnaires and upload evidence in their own portal, without a Certifyi licence.
- Reassessment by tier
- Critical vendors are reassessed more often than low-risk ones.
AI-drafted answers
AI drafts answers for you to review. For each question it searches your control library and evidence and proposes a response based on what you actually do.
A draft is a proposal. Someone on your team checks it against the control and evidence, edits it if needed, and accepts it.
Questionnaire dashboard
The dashboard lists every open questionnaire with its status: draft, in progress, submitted or overdue. Filter by direction (inbound or outbound), vendor tier or due date.
| Questionnaire | Direction | Status | Due |
|---|---|---|---|
| Acme Corp security review | Inbound | In progress | 15 Nov |
| Cloud vendor annual | Outbound | Submitted | 1 Nov |
| Payment processor PCI | Outbound | Overdue | 10 Oct |
| Enterprise prospect review | Inbound | Draft | 30 Nov |
Status of each open questionnaire, inbound and outbound. Example data, not a customer record.
What it covers
Questionnaires draw on the control library and evidence you already keep in Certifyi.
-
Both directions
Send questionnaires to your vendors and answer your customers’ questionnaires in the same place.
-
AI-drafted answers
AI drafts answers from your controls and evidence. A person reviews and accepts each one.
-
Answers from your controls
Each answer draws on the same control library you keep up to date for your audits, so what you tell a customer matches what you show an auditor.
Related modules
Questionnaire answers come from your controls and evidence, and vendor responses feed vendor risk.
How Certifyi helps
How Certifyi handles security questionnaires
Outbound and inbound questionnaires answered from one control library, with AI drafts that a person accepts.
-
Your own questionnaires
A builder for the questionnaires you send to vendors.
-
Answers from your control library
Bring in customer questionnaires, match questions to controls, and review AI-drafted answers.
-
Vendor assessments
Send questionnaires through the vendor portal.
-
Status in one place
A dashboard showing the status of each open questionnaire.
Questions
Security questionnaire questions
Can I import a questionnaire a customer sent me?
Yes. Bring in the customer’s questionnaire and Certifyi matches the questions to your control library and suggests answers from your existing controls and evidence.
How does the AI draft responses?
It searches your control library and evidence for information relevant to each question and drafts an answer. The draft is a proposal: someone on your team reviews it and accepts it before anything is sent.
Do vendors need a Certifyi licence to complete questionnaires?
No. Vendors answer questionnaires and upload evidence in their own portal. They do not need a Certifyi account or licence.
Can I schedule recurring vendor assessments?
Yes. Set how often each vendor tier is reassessed, and see overdue responses on the dashboard.
Are previous responses reused?
Answers come from the same control library each time, so a control you documented once can answer the same question for the next customer.
Answer the next questionnaire from your control library
Have a questionnaire from a recent deal to hand when you book a walkthrough. We will run it against an example control library, so you can judge the AI drafts, and the review step that follows, on questions you already know.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them