Example questionnaire
From a question to an answer you can check.
Open each question to see a draft, its supporting material and what a reviewer still needs to confirm.
Illustrative walkthrough. All documents and responses below are fictional, not claims about Answerfile's own security controls.
How do you review access to production systems? Needs review
System owners review access to production systems at least quarterly. Reviews record changes to permissions and when those changes were completed.
Source: Access control policy, section 2.1
“System owners review access to production systems at least once every quarter. The review records any changes to permissions and the date they were completed.”
Reviewer check: Confirm that this policy is current and that the latest review was completed. A policy describes a requirement, not evidence that it happened.
How quickly is access removed when an employee leaves? Needs confirmation
Access removal is part of the employee offboarding process. The system owner receives an offboarding request and records completion.
Source: Employee offboarding checklist, section 3
“Notify the system owner of the departure and record completion of account removal.”
Reviewer check: The source does not specify a time limit. Ask the owner before promising same-day removal or a fixed service level.
Do you support customer-managed encryption keys? No supporting source
No supplied document establishes whether customer-managed keys are supported.
Reviewer check: Refer this question to the infrastructure owner. General statements about encryption are not enough to answer it.
The best draft makes the remaining work clear.
Source references, explicit gaps and a final human review.