An enterprise customer’s security review has stalled the deal
The useful move is to stop treating it as a document exercise. A questionnaire is a list of technical controls with a deadline attached, and most of them are engineering work.
Usually raised by: CTO or VP Engineering, working alongside commercial and security colleagues.
What normally triggers it: A security questionnaire, a vendor assessment, or a procurement review that named specific controls you cannot currently evidence.
- AWS
- Terraform
- GitHub Actions
You probably recognise some of these.
Not all of them, and not in this order. If three or four land, this is the page you want.
- A customer sent a questionnaire and several answers would currently have to be "no" or "partially".
- Access is broader than anyone would choose to describe in writing.
- Encryption depends on when a resource happened to be created.
- There is a date, and it is attached to revenue.
What is different afterwards.
The questionnaire becomes a prioritised engineering backlog with named controls, and the gaps that can be closed before the date get closed — with the evidence handed to whoever has to answer.
The work itself
- Turn the customer’s actual requirements into a list of named technical controls, in their words and your estate.
- Establish which are already satisfied and can be evidenced today.
- Prioritise the remainder by what the customer is actually asking and what can be done in the time available.
- Implement the agreed controls as code, through your review process.
- Assemble the evidence — configuration, logs, screenshots of the real thing — and hand it to the person answering.
Who does it: an InfraEdge engineer, who walks your team through what was found and answers your reviewer on each change.
One requirement, from questionnaire to answer.
“Is customer data encrypted at rest, and how is this enforced?”
from the customer’s questionnaire, in their wordsEncryption required in the module every data store is built from — not set per resource, where the next one forgets.
storage_encrypted = true · applied through a reviewed pull requestThe live configuration, collected read-only, tied to the control it supports.
rds_instances.json · hashed and timestamped“Yes — enforced in code, evidence attached.” Written by your team, from material they can defend.
Requirements mapped, and the top gaps closed
One questionnaire or review, one estate, and the controls you and we agree are both material and reachable before the date.
Done when
Every requirement is marked satisfied, in progress or out of scope with a reason; the agreed controls are implemented and reviewed; and the evidence pack is in the hands of the person who has to answer the customer.
What you receive
- A requirement-by-requirement position, including the honest "not yet" entries
- The implemented controls, as code in your repository
- An evidence pack tied to each control it supports
- A written list of what remains, and what it would take
What we need from you
- The actual questionnaire or review document, not a summary of it
- A scoped read-only role, and a named reviewer for changes
- Whoever owns the commercial relationship, available for the scoping conversation
What makes it larger or smaller for you.
The variables that drive the size, judged against your own estate.
Larger if
- Controls that have to hold across many accounts rather than one
- Logging that has to be centralised before anything can be evidenced
- Encryption on resources created years apart, under different defaults
Smaller if
- A single account or a single product boundary
- Most controls already satisfied, needing evidence rather than engineering
- A questionnaire that names controls rather than asking open questions
For a sense of elapsed time on work of this shape, the phased timeline on a comparable engagement is published with it. We do not quote a duration for your estate before seeing it, and the scope you receive after the call names the package rather than an hourly rate.
What this does not include.
Stated here rather than discovered later.
- We cannot certify you as compliant, and nobody who is not an independent auditor can. A SOC 2 report is issued by an auditor and ISO 27001 certification by an accredited body.
- We do not guarantee that a customer will accept your answers. We close the engineering gaps and evidence them; the customer’s judgement is theirs.
- Penetration testing and application security auditing are specialist disciplines we are not qualified to sell. Where a questionnaire genuinely requires one, we will say so and introduce people who do it properly.
Is this not just paperwork we could do ourselves?
The mapping is, and some teams should. What is rarely quick in-house is the engineering underneath: centralising logging across accounts, narrowing access things depend on, making encryption consistent across resources created years apart. If your gaps are answerable rather than buildable, we will say so on the call and you should do it yourselves.
What we can point at.
Anonymised prior delivery, described by technical shape. No client names, no logos, and no figures we did not measure.
Evidence — anonymised prior delivery
- Compliance readinessA B2B SaaS company’s AWS estate hardened ahead of a SOC 2 readiness programme — IAM, logging, encryption, backups and access reviews, with technical evidence produced for the audit.
- Launch readinessA platform readied for its largest enterprise customer yet — scaling, database resilience, deployment controls and monitoring reviewed, with the highest-risk changes made before launch.
Problems that tend to arrive together.
Accounts, identity and networking no longer fit the organisation
Usually the structure was right for the company that built it, and that company no longer exists.
Backups are running, but nobody has restored one
A backup job that reports success tells you a job ran. It does not tell you how long a restore takes, whether the thing that comes back is usable, or who would do it at two in the morning.
Describe the project
Twenty minutes, no charge, with the engineer who would do the work. We work out whether this is the work you need and whether we are the right people — which is sometimes us and sometimes not. Nothing is priced on the call; if there is work worth doing, a written scope and a price reach you within 24 hours.