Security Questionnaire Short Answers

Draft short answers for a security questionnaire. If I do not know a control, the answer is "not in place" or "unknown," not a hopeful paragraph. COMPANY Product: [PRODUCT] Data we hold: [TYPES] Hosting: [AWS | GCP | AZURE | OTHER — REGION IF KNOWN] Auth: [SSO, MFA — WHAT IS TRUE] Encryption: [AT REST / IN TRANSIT — WHAT IS TRUE] Backups: [WHAT IS TRUE] Subprocessors I can name: [LIST] Certifications we have: [SOC2 TYPE, ISO, OR NONE] Pen test: [DATE AND WHETHER WE CAN SHARE A LETTER | NONE] Incident contact: [EMAIL] FOR EACH TOPIC BELOW, WRITE A 2–4 SENTENCE ANSWER I CAN PASTE, PLUS A BRACKET IF I MUST CONFIRM A FACT Access control, MFA, encryption, backups and restore tests, logging, vulnerability management, subprocessors, incident response, data retention and deletion, and whether customers can get a DPA. End with a gap list: controls a buyer will expect that I marked unknown or absent, ordered by how often they block a deal. Do not claim SOC 2, pen tests, or bug bounties I did not list.