Security Assessment & Questionnaires
Security questionnaires, ISO 27001, SOC 2 and NIST assessments, and vendor security reviews.
12 articles
- Security Questionnaire Automation: How AI Answers Faster Without Overpromising Vendors face dozens of security questionnaires a month. Learn how AI questionnaire automation works, where it goes wrong, and how to keep answers accurate.
- How to Review a Vendor SOC 2 Report: A 10-Point Checklist for 2026 Over half of SOC reports in one benchmark had exceptions. Use this 10-point checklist to review vendor SOC 2 reports: opinion, scope, CUECs, carve-outs and more.
- ISO 27001 Gap Analysis: Checklist and Software Guide for 2026 ISO 27001:2013 certificates expired Oct 31, 2025. Run an ISO 27001:2022 gap analysis with this clause and Annex A checklist and pick the right software.
- NIST CSF 2.0 Gap Assessment Template: Current vs Target Profiles Run a NIST CSF 2.0 gap assessment with Current and Target Profiles across all six functions, including Govern. Template, steps and 2026 updates.
- Cybersecurity Risk Assessment: A Step-by-Step Guide for 2026 How to run a cybersecurity risk assessment with NIST SP 800-30 and CSF 2.0: scope, assets, threats, likelihood and impact, control evidence and 2026 data.
- AI Security Assessment: How to Assess the Security of AI and LLM Systems How to run an AI security assessment in 2026: scope, the OWASP Top 10 for LLMs, NIST's adversarial ML taxonomy and draft Cyber AI Profile, and testing.
- NIST Assessment Guide: NIST 800-171 Self-Assessment, CMMC and Security Control Assessments Which NIST assessment you need: SP 800-171 self-assessments and CMMC (Phase 2 from November 10, 2026), SP 800-53A control assessments and evidence.
- ISO 27001 vs SOC 2 Assessment: Choosing a Security Compliance Assessment How ISO 27001 certification and SOC 2 examinations differ, what each involves, where FedRAMP fits, and how to prepare evidence once for several frameworks.
- Vendor Security Assessment: Process, Evidence and Software How to run a vendor security assessment in 2026: what to ask, which evidence to verify (SOC 2, ISO 27001, CMMC), assessing AI vendors and what to automate.
- Third-Party Risk Management (TPRM): Lifecycle, Regulations and Assessments What third-party risk management is, the TPRM lifecycle in US banking guidance, what DORA, the SEC and DOJ expect, and how to assess third parties.
- Vendor Risk Assessment: Questionnaires, Evidence and Scoring How to run a vendor risk assessment that holds up: tiering, CAIQ questionnaires, reviewing SOC 2 reports, verifying answers against evidence and scoring.
- TPRM Software and Third-Party Risk Automation: What to Automate and How to Choose What TPRM software does, which parts of third-party risk can be automated, where AI helps review vendor documents and what to ask before buying.
Subjects covered
- security assessment
- security assessment software
- security questionnaire
- security questionnaire automation
- security questionnaire software
- security compliance assessment
- cybersecurity risk assessment
- security control assessment
- security audit automation
- security compliance automation
- vendor security assessment
- vendor security questionnaire