Security questionnaire evidence readiness checklist

Before you answer a security questionnaire\n\nSecurity questionnaires become risky when teams answer from memory instead of approved evidence. Gather the source material first.\n\n### Evidence to prepare\n\n- Access-control and authentication policy\n- Administrator MFA requirements\n- User-access review policy and frequency\n- Encryption standards for data in transit and at rest\n- Incident-response policy\n- Backup and recovery policy\n- Data-retention and deletion policy\n- Vendor or subprocessor policy\n- Security-awareness training policy\n- Vulnerability-management policy\n- Current certifications or audit reports, if actually held\n- Approved architecture or security-overview material\n\n### Grounding rule\n\nIf an answer is not directly supported by approved source material, mark it unsupported rather than guessing. This protects sales velocity without creating compliance risk.