Security Questionnaire Automation Glossary

Questionnaire responses drafted or suggested by AI using approved source content and workflow context.

How much a tool lets you connect and automate it through its API.

A measure of whether reusable questionnaire answers still reflect current policies, controls, systems, and commitments.

The person responsible for keeping a particular answer correct and current.

A governed repository of reviewed answers that teams reuse across questionnaires, RFPs, DDQs, and customer questions.

The person who gives final sign-off before an answer is sent.

A tamper-resistant record of who did what and when in the system.

A browser add-on that helps fill out questionnaires inside other web pages.

A standard cloud-security questionnaire from the Cloud Security Alliance.

Linking your security-review tool to your CRM so deal data stays in sync.

A version-by-version record of how an answer or document changed over time.

A security answer that shows exactly which document or record it came from.

AI that either backs up its answer with a source or says it cannot answer.

Software that automatically gathers evidence and checks controls to keep you compliant.

A rating showing how sure the system is about an answer it produced.

When two of your documents disagree about the same answer.

A schedule for regularly checking that your saved answers are still accurate.

The review a customer or prospect performs to evaluate a vendor’s security, privacy, and compliance posture.

The operating discipline of making security, privacy, and compliance posture understandable and verifiable for customers.

A questionnaire used to vet a vendor or partner before working with them.

A contract setting the rules for how a vendor handles personal data on your behalf.

The percentage of security questions answered by your trust center instead of by hand.

Linking your security tool to where your documents are stored.

The process of collecting, maintaining, reviewing, and sharing supporting proof behind security questionnaire answers.

A request to allow a known risk for now, with sign-off and an expiry.

A combined approach to running governance, managing risk, and meeting compliance obligations.

A trust center that makes visitors sign in or request access before seeing sensitive documents.

AI that answers using only your approved documents, not whatever it happens to know.

The chance that AI confidently states something that is simply not true.

A control pattern where people review, approve, or reject AI-generated security answers before external use.

A certificate showing a vendor's security management system meets the ISO 27001 standard.

The risk a vendor poses before any safeguards are considered.

A starter form that collects basic details to kick off a vendor review.

Turning security-review follow-ups into tracked Jira tickets for the right team.

Lawyers reviewing the contract terms tied to a vendor relationship.

Access to sensitive documents only after the viewer agrees to an NDA.

A buyer-run portal, in this case associated with OneTrust, for completing vendor assessments.

Exporting completed questionnaire answers back into the buyer’s requested spreadsheet, document, PDF, or portal format.

A report from an authorized hacking test showing what weaknesses were found.

The workflow of entering questionnaire answers into third-party buyer or vendor-risk portals, often with browser support.

A trust center visible only to approved or signed-in viewers.

The buyer's process for approving a vendor purchase, including security checks.

A trust center anyone can view without signing in.

The routing and review process used to approve questionnaire answers before they are sent to a buyer.

A dashboard showing the status and ownership of each questionnaire.

The elapsed time between receiving a questionnaire and returning an approved response package.

A formal request asking a vendor to share information about its offering.

A formal request asking vendors to propose a solution, usually with security requirements.

Re-checking an existing vendor's security on a schedule or after a change.

A request asking a vendor to fix a problem found during review.

A security check done when a vendor contract is up for renewal.

The risk left over after safeguards are in place.

Passing a deal between sales and other teams without losing security-review context.

The person who checks a draft answer for accuracy before it moves forward.

Rating a vendor or finding to express how risky it is.

A widely used standard vendor-risk questionnaire from Shared Assessments.

Assigning difficult, sensitive, or unanswered questionnaire items to the right subject-matter expert.

An independent audit report on a vendor's security controls; Type II covers a period, Type I a single date.

A technical review where a sales engineer helps answer a buyer's security questions.

Managing security-review tasks directly inside Salesforce, linked to the deal.

The practice of keeping all your security claims accurate, sourced, and up to date.

A buyer or vendor assessment document used to evaluate a company’s security, privacy, compliance, and operational controls.

Software-assisted workflow for drafting, reviewing, approving, and reusing answers to customer security questionnaires.

The source library of approved answers, documents, policies, evidence, and context used to support questionnaire responses.

Software that helps teams answer inbound customer security questionnaires with reusable content, evidence, and review workflows.

Getting answers or documents approved through requests sent in Slack.

A reference that shows which source document, answer, policy, control, or evidence item supports a questionnaire response.

The one place that holds the official, approved version of an answer.

An old answer that is now out of date because something changed.

A list of the outside parties a vendor relies on to handle your data.

The practice of assessing and monitoring the risks vendors bring to your organization.

A buyer-facing destination for security, privacy, compliance, and assurance materials.

Reports showing who viewed or requested documents in your trust center.

Answering a buyer's security questions through a self-serve page instead of filling out their form.

A buyer-run website where vendors fill out and submit security questionnaires.

A buyer-side review used to evaluate the risk of working with a supplier, vendor, or third-party service provider.

The diligence process a buyer uses to understand a vendor’s security posture before or during procurement.

An automatic notification one tool sends another when something happens.