Questionnaire Register
For whoever answers the customer's security questionnaire before the deal can close

Read the customer's questionnaire before you write a word of the reply.

Paste the questions of an inbound security questionnaire. Get each question matched to the clause it tests, the questions that ask the same thing grouped so you answer once, the evidence an assessor expects for each, the questions that reach beyond your certification, and the questions no standard we hold asks, set apart for a person to answer.

Read your own questionnaireEight questions free, no account. The dictionary and the clause text load with the page and every placement runs in your browser; nothing you paste leaves it until you choose to save.
Specimen: an invented bank's vendor assessment7 of 40 questions
  1. 3Please provide your most recent SOC 2 Type II report or bridge letter. beyond your certificate[ISO 27001 5.35]placed by wording
  2. 8Is strong authentication, such as MFA, required for every user who can reach bank data? asked more than once[ISO 27001 8.5]placed by code, IAM-14
  3. 9Is multi-factor authentication enforced for all remote access? asked more than once[ISO 27001 8.5]placed by wording
  4. 15Is bank data encrypted in transit over public networks? old numbering[ISO 27001 8.24]placed by code, A.10.1.1
  5. 26Will you tell the bank within 24 hours of confirming a breach that affects our data? timeframe asked[ISO 27001 5.24]placed by wording
  6. 32Which providers host the platform for you, and how are they selected and overseen? doubtful[ISO 27001 5.22]runner-up: subprocessors
  7. 36Do you hold cyber insurance? State the limit. needs a personno clausefor finance
40 questions: 33 placed, 1 doubtful, 1 unplaced, 5 needing a person. 8 questions fall in 4 repeat groups, so 36 things to answer. Of the 33 placed, 31 sit within ISO 27001 as held and 2 beyond it. The full run is below the paste box.
Two colleagues at a desk going down a spreadsheet on a laptop beside a stack of files
Know within a minute which rows your certificate already covers, which ones repeat, and which belong to finance or legal, before the deadline on the customer's form. It reads the questionnaire itself against the held clause text, question by question, with no library of past replies to build first and nothing sent from your browser.
01

Paste the questions as they came

The customer's spreadsheet, the SIG, the CAIQ, a hospital's vendor form or a bank's own list: one question per line, with its reference and section if the sheet has them. Every question is matched against a published dictionary of 38 question families in nine groups; a reference code places it first, the wording second, and a question that matches nothing is marked unplaced and never guessed.

02

Read what each question tests

Per question: the family, the anchor clause in every framework ticked, how it was placed (by code, by wording, or doubtful with its runner-up), the evidence an assessor expects, and the findings it raises. Per register: questions by group, the things to answer once repeats are grouped, the questions within your certificate and those beyond it, and the ones set apart for a person.

03

Take the plan to the people who reply

The answer plan gives one row per thing to answer, the questions it covers, the anchor clause and the evidence to attach, with an owner column left for you. The clause map goes back to the customer beside your replies. The reviewer summary holds the doubtful, unplaced and needs-a-person rows for the security lead.

Why a register and not a response platform

Response platforms are built for teams big enough to feed them a library of past replies. The supplier's security lead still gets the 300-row spreadsheet on Friday, with the deal waiting on it. Before anyone writes a reply, somebody has to know what each question is really asking, which ones ask it twice, and which reach past the certificate on the wall. That is the register this builds, in your browser, from the questions as they came.

The dictionary is ours and published in full: every question family, in nine groups, what each framework anchors and what each kind of customer usually asks. The register reads the questions only: it writes no reply, and says nothing about how you fare against a question.
One question per line, as it comes out of the customer's spreadsheet: Question, or ID | Question, or ID | Section | Question. Tabs, pipes, commas or a CSV export; a header row is optional and an answer column is ignored. A reference like A.9.4.2, IAM-02, CC6.1 or PR.AA-03 places the question by code. A first line we hold: ISO 27001 | customer: bank | as at: 2026-09-23 sets the certificate, the customer and the date.
The frameworks ticked are the ones whose clauses each question shows; the customer type ticks its usual set. Nothing is sent anywhere until you choose to save.