Approach
We start with a real questionnaire.
Not with a framework, and not with a compliance programme. With the questionnaire sitting on your desk, because it shows exactly what you lack and what your market genuinely requires.
-
01
Assessment
We take the questionnaires already received and the requirements of your target clients, then set each requirement against what you can actually produce as evidence. The report states what is demonstrable today and what is not.
- Inventory of requirements by client and sector
- Real state of the available evidence
- Gaps ranked by commercial impact
-
02
First questionnaire
We handle one real questionnaire end to end, with you, within its deadline. This is the exercise that produces the first answers in the library and exposes the points where your organisation cannot answer.
- Completed questionnaire, approved internally
- First answers added to the library
- List of questions left without evidence
-
03
File and review
Building the full library, setting up the remediation plan, then periodic review and support on incoming questionnaires. The monthly fee is what stops the file becoming wrong.
- Answer library with sources and owners
- Prioritised remediation plan, tracked
- Periodic review and questionnaire support
Why prioritisation is commercial, not technical
A security framework ranks controls by theoretical risk. A useful remediation plan ranks them by what blocks a signature. They are not the same list, and confusing the two means spending in the wrong place.
Concretely: a control twelve clients out of fifteen ask about comes before a more serious one nobody asks about. That does not mean the second one does not matter; it means it does not carry the same urgency, and the trade-off should be explicit rather than accidental.
We write that trade-off into the plan, with its reasoning. If your management wants to overturn it for other reasons, they do so knowingly.
What is included, what is not
| Topic | Included | Out of scope by default |
|---|---|---|
| Answers | Drafting backed by your existing evidence | Drafting an answer the evidence does not support |
| Evidence | Collection, formatting, dating | Producing the missing technical controls |
| Certification | Preparing the file | Issuing a certificate, accredited audit |
| Legal | Referral to your own counsel | Legal opinion, contract drafting |
| Technical | Describing what exists | Development, hardening, penetration testing |
Request an assessment
Let's talk about the next questionnaire
Tell us who is asking, by when, and what usable evidence you already hold. We reply within two working days, in English, French or German.
- Swiss engineering
- Reply within two working days
Email Certenor
A questionnaire on your desk and a short deadline? That is the right moment to write to us.
Email Certenor