Built for small MSPs

Client security questionnaires, completed in 3 working days.

SIG, CAIQ or a bespoke vendor form lands right before a contract is signed. We complete it for you, so the deal can close, without you losing a day to a spreadsheet.

✓ Pay only if you're happy ✓ You sign off every answer See how it works →

We complete: SIGCAIQCSA STARbespoke vendor forms

CAIQ · completing…

COMPLETE

REVIEWED · SIGNED OFF

A&A-01.1Audit & assurance policies established and maintainedBasis: Information Security Policy, §4

YES

A&A-02.1Independent assessments at least annuallyBasis: ISO 27001 surveillance audit, annual

YES

A&A-03.1Assessments triggered by significant changeBasis: risk reviews evidenced; change trigger not documented

PARTIAL

IAM-01.1Identity & access management policy enforcedBasis: Access Control Policy, §2 · MFA enforced

YES

DSP-05.1Data classification applied to all dataNot found in your documents — flagged for you

CONFIRM

The transformation

From their spreadsheet to your submission.

And this is the full job, not just five rows: a 400-row vendor form with every cell empty, returned submission-ready — every answer sourced, gaps flagged, signed off.

VendorSec_Questionnaire_2026_FINAL_v7.xlsx INCOMPLETE · 0% DONE

ABCDEFG

AC-01Is multi-factor authentication enforced for all privileged access?INCOMPLETE

DP-04Is customer data encrypted at rest using AES-256 or equivalent?—

IR-02Do you maintain a documented incident response plan tested annually?—

BC-07Are RTO and RPO objectives formally defined for critical systems?—

VM-03Are vulnerability scans performed on at least a quarterly cadence?—

AC-09Is access de-provisioned within 24 hours of termination?INCOMPLETE

GC-01Do you hold a current SOC 2 Type II report covering security?—

NS-05Is network traffic segmented between production and corporate?—

DP-11Are data retention and secure deletion policies enforced on PII?—

LG-02Are audit logs centrally collected and retained for 12 months?—

CM-01Is change-management approval required before production deploys?INCOMPLETE

PE-03Do you perform background checks on staff with data access?—

VM-09Do you conduct annual independent penetration testing?—

SD-06Are production secrets stored in a managed vault, not source?—

MA-02Is security-awareness training mandatory annually for all staff?—

AC-14Are encryption keys managed via a dedicated KMS?—

VENDOR SECURITY ASSESSMENT

Security Questionnaire

SOC 2 Type II · ISO 27001 · Reviewed · Signed off

COMPLETED

REVIEWED · SIGNED OFF

AC-01Is multi-factor authentication enforced for all privileged access?YES

DP-04Is customer data encrypted at rest using AES-256 or equivalent?YES

IR-02Do you maintain a documented incident response plan tested annually?PARTIAL

BC-07Are RTO and RPO objectives formally defined for critical systems?CONFIRM

VM-03Are vulnerability scans performed on at least a quarterly cadence?YES

GC-01Do you hold a current SOC 2 Type II report covering security?YES

142 / 142 CONTROLS ANSWERED

How it works

Three steps, about 15 minutes of your time.

Send it over

Forward the questionnaire and your existing security docs: ISO cert, policies, any prior answers.

We complete it

We answer only from what your documents support, and flag anything that needs your sign-off. We never invent a control you don't have.

You sign off

Review, confirm the flagged points, and submit. Submission-ready in 3 working days.

Why MSPs use us

Accurate where it counts, honest where it matters.

Sourced, not bluffed

Every answer ties back to your own documents. Genuine gaps are flagged for you, because a confident wrong answer is what fails a security review.

Built for small MSPs

Not enterprise software repriced down. A single flat fee for the job in front of you, no platform to learn or subscribe to.

You stay in control

It comes back as a draft you own and sign off. Your name goes on it, so the final call is always yours.

YESPARTIALCONFIRM

See exactly how it comes back.

A real worked example: a slice of a CAIQ, completed from a sample MSP's documents.

See a worked example

🔒

Your data stays yours. Documents are handled in a private account, never used to train any AI model, never shared, and deleted after delivery. Happy to sign an NDA first, or work from a redacted set.

FAQ

Questions, answered.

Can't I just use ChatGPT or the free tools?

You can, and for a single easy question it might be fine. The problem is a full questionnaire: a general tool will happily invent a control you don't actually have, and a confident wrong answer is exactly what fails a security review and stalls the deal. We answer only from your own documents, flag the genuine gaps instead of guessing, and hand you a draft that's ready to submit. You're paying to take a day off your plate and not have to check every line.

Is my data safe?

Yes. Your documents are handled in a private, access-controlled account, never used to train any AI model, never shared, and deleted once your questionnaire is delivered. We're happy to sign an NDA before you send anything, or to work from a redacted set. The full detail is on our privacy page.

What if I'm not happy?

Then you pay nothing. The £349 is due only once the questionnaire is submission-ready and you're happy with it. If the result isn't useful, it costs you nothing, no negotiation.

How long does it take?

Three working days from when we have the questionnaire and your supporting documents. It takes about 15 minutes of your time: forward it over at the start, then review and sign off the flagged points at the end. If your deadline is tighter than three days, tell us and we'll say honestly whether we can hit it.

What formats do you handle?

SIG (Standardized Information Gathering), CAIQ (Cloud Security Alliance), and bespoke vendor and client questionnaires, whether they arrive as a spreadsheet, a web portal, or a Word document. If you've been sent something in a format you're not sure about, send it over and we'll confirm we can complete it before you commit to anything.

Who's behind this

A person, not a platform.

I'm James. I built ComplianceCrib after watching small MSPs lose whole days — usually a director's — to security questionnaires that land right before a deal signs.

I'm a final-year business student, not a big compliance firm, and I won't pretend otherwise. What you get is careful work: every answer drafted from your own documents, and I personally review every line before it comes back to you. Anything your documents don't support gets flagged, never guessed.

You review it, you sign it off, and you only pay if it's useful.