@Dash the security questionnaire from the prospect is attached. 92 questions. How much of it can you do?
Live in Slack or Microsoft Teams
Answer a security questionnaire from your docs
A prospect sends a 92 question security review. Dash answers the questions your policy documents already cover, cites the document and section behind each answer, and flags the ones with no supporting policy rather than filling them in.
Get started for free Chat with Dash, the AI teammate that works inside Slack and Microsoft Teams.
Answered 71 of 92 from the policy set in Drive. Each answer carries the document and section it came from, so the reviewer can check it.
- Answered with a cited source · 71
- Answered, but the source is older than 12 months · 9
- No supporting policy found · 12
The twelve gaps are the useful part. They cluster: four on subprocessor notification, three on secure development, three on physical access to the office, two on breach notification timing. There is no document that answers them, so I have left them blank rather than writing something plausible.
The nine stale ones are answerable but the policy behind them was last reviewed 14 to 20 months ago. I have marked each one so you can decide whether to refresh the doc or answer as is.
Draft the four subprocessor answers from the DPA, that language exists there.
Found it. The DPA covers subprocessor notification in section 7 and the answers follow from it directly, so those four are now drafted and cited to the DPA rather than to a security policy.
One caveat. The DPA commits to 30 days notice. The questionnaire asks for 45. I have answered with the true 30 rather than matching what they asked for, and flagged it as a negotiation point for the deal team.
Eight gaps remain. Nothing has been sent to the prospect.
Teams @Dash the security questionnaire from the prospect is attached. 92 questions. How much of it can you do?
Answered 71 of 92 from the policy set in Drive. Each answer carries the document and section it came from, so the reviewer can check it.
- Answered with a cited source · 71
- Answered, but the source is older than 12 months · 9
- No supporting policy found · 12
The twelve gaps are the useful part. They cluster: four on subprocessor notification, three on secure development, three on physical access to the office, two on breach notification timing. There is no document that answers them, so I have left them blank rather than writing something plausible.
The nine stale ones are answerable but the policy behind them was last reviewed 14 to 20 months ago. I have marked each one so you can decide whether to refresh the doc or answer as is.
Draft the four subprocessor answers from the DPA, that language exists there.
Found it. The DPA covers subprocessor notification in section 7 and the answers follow from it directly, so those four are now drafted and cited to the DPA rather than to a security policy.
One caveat. The DPA commits to 30 days notice. The questionnaire asks for 45. I have answered with the true 30 rather than matching what they asked for, and flagged it as a negotiation point for the deal team.
Eight gaps remain. Nothing has been sent to the prospect.