The deal is waiting on a 240-question security review, and the answers live in last year's answers.

The situation

Why every questionnaire takes three days

The company's actual security posture is fine — SOC 2 Type II, sensible access controls, a real incident-response plan. The problem is that the evidence lives in a dozen places: the audit report, an internal wiki, policy PDFs, the pen-test summary, and the heads of two engineers. When question 117 asks about key rotation, whoever is answering hunts, guesses, or copies what was said last time.

Copying is the real hazard. Last year's answers described infrastructure that has since changed — a data-residency answer that predates the new EU region, an encryption answer naming a deprecated cipher suite, a subprocessor list missing two vendors. Each stale answer either misrepresents the company in a signed document or triggers a security-team correction late in the deal.

Sales wants speed; security wants accuracy; both want to stop resenting the process. The library that would fix it — current, sourced, owned answers — never gets built because everyone is busy answering the next questionnaire.

The work

What Taz builds for this company

Taz builds the sourced answer library first, then the drafting workflow on top of it — so every drafted answer traces to a current, security-approved source.

• Source library construction: Every security-relevant document — SOC 2 report, policies, architecture notes, pen-test summaries, subprocessor list — is inventoried, dated, and mapped to the topics questionnaires actually probe: encryption, access control, incident response, business continuity, data residency, vendor management.
• Canonical answer bank: Recurring questions get canonical answers written from those sources, each with a citation, an owner, and a review date. Where the sources conflict or are silent, that's logged as a gap for security to resolve — not papered over.
• Requirement matrix workflow: Each incoming questionnaire is decomposed into a matrix: question, mapped canonical answer, confidence, and flags. Unmatched questions are routed to the named owner instead of improvised.
• Red-flag detection: Drafts are checked for the failure modes that burn deals — absolute claims ("we have never had an incident"), certifications the company doesn't hold, commitments legal hasn't approved, and answers contradicting the SOC 2 report. Every flag cites the conflicting source.
• Review-and-sign workflow: The output is always a draft package for human signoff: completed matrix, flagged items, gap list, and the formatted response document. Security reviews flags and gaps, not all 240 rows.

The deliverable

What the company receives

• Sourced answer library — canonical answers with citations, owners, and review dates, structured so it stays maintainable after handover.
• Gap and conflict report — every question the current documentation cannot support, and every place two sources disagree, as an explicit worklist for the security team.
• Requirement matrix template and workflow — the repeatable decompose-map-flag process, demonstrated end-to-end on one real questionnaire during the engagement.
• Red-flag rulebook — the written checks applied to every draft, extensible by the security team as they encounter new failure modes.
• Completed pilot questionnaire — one real buyer questionnaire processed through the desk: matrix, flags, draft, and the security-approved final, proving the turnaround claim on the company's own deal.