THE RFPIO BLOG

Start Responding Like a Pro

The RFPIO blog is full of insights and best practices, giving you the tools you’ll need to streamline your process and respond with confidence.

Featured Post

Security questionnaires: 6 processes before and after automation

Security questionnaires: 6 processes before and after automation

Product & Best Practices

Security questionnaires have become a household name for modern organizations. When the opportunity for new business presents itself, data concerns […]

December 9, 2019

Category: Tag: Security questionnaire best practices

Security questionnaires: 6 processes before and after automation

Product & Best Practices

Security questionnaires have become a household name for modern organizations. When the opportunity for new business presents itself, data concerns accompany that opportunity. From vendor security assessments to due diligence questionnaires, complex spreadsheets are a part of daily life for responders with technical expertise.

56% of RFPIO customers use our software to respond to security questionnaires. Security questionnaire automation helps these teams collaborate in a meaningful way and eliminate manual workarounds.

See what life was like before and after security questionnaire automation for six responders. They transformed their process…and so can you.

Collaboration ease with vendor security assessments

Before security questionnaire automation

A senior account executive was frustrated with their internal process of receiving, managing and completing vendor security assessments—and she knew there had to be a better way. The ability to build out an Content Library was her primary objective, as a centralized content hub would align resources and responses. She began evaluating security questionnaire automation platforms to find the best feature stack.

After security questionnaire automation

RFPIO presented neatly categorized information so security questionnaire contributors could complete any project successfully. Security questionnaire automation streamlined the entire process of receiving, managing, and completing vendor security assessments. RFPIO remained responsive to questions and feedback to further support her team’s success.

Security questionnaires tackled by 100+ contributors

Before security questionnaire automation

A director of presales support spent her days wrangling responses (and resources) for security questionnaires, RFPs, and RFIs. Many business units participated in responding to lengthy, repetitive security questionnaires. With so many voices—and a decentralized Content Library—they lacked consistency with their responses, which affected the content quality and win potential for all of their submissions.

After security questionnaire automation

Today over 100 contributors actively use RFPIO and they add new users every week. This director of presales support has integrated users from IT, HR, Legal, Finance, Professional Services, and Education Services. Across departments, team members feel more productive since they process multiple projects simultaneously. Now documents are more consistent and higher on the quality scale.

Centralized database for faster response completion

Before security questionnaire automation

A proposal manager and his response management team completed many security questionnaires from healthcare organizations annually. Since responses were not centralized, SMEs could not find relevant content easily. This team spent roughly 16 hours to complete a single security questionnaire.

After security questionnaire automation

On their first live security questionnaire project in RFPIO, this response management team saw immediate time-saving benefits. Multiple people now collaborated on the same response, eliminating back and forth communication via email and phone calls. The proposal manager viewed progress within the project overview dashboard—offering visibility he never had before so he could stay ahead of deadlines.

100 security questionnaire responses in two hours

Before security questionnaire automation

An information security advisor led the response process for security questionnaires, due diligence questionnaires (DDQs), and RFPs. His presales, sales, and information security teams were all involved, answering 100-700 technical questions on a regular basis. Without security questionnaire automation, they relied on a FAQs document that contained 300 responses to their most common repetitive questions.

After security questionnaire automation

RFPIO’s answer recommendation engine gave the team newly discovered superpowers with security questionnaire responses. They set up their Content Library with past security questionnaires and RFPs. When they started a new project, they leveraged the recommendation engine to fill in most of the responses. This team now responds to 100 questions in two hours.

Enterprise collaboration with the end-user in mind

Before security questionnaire automation

A global RFP manager handled a large number of IT security questionnaires, DDQs, vendor applications, and RFPs for enterprise organizations. He wanted to build a scalable and repeatable response process centered around a cloud-based software system. He evaluated several security questionnaire software providers to find the best platform and pricing structure.

After security questionnaire automation

A collaborative environment was key for such a complex organization. This global RFP manager recognized RFPIO’s authentic focus on teamwork, which allowed quick collaboration among SMEs without license limitations. Throughout their entire group of companies, RFPIO easily allowed him to invite multiple contributors, authors, and reviewers to tackle lengthy security questionnaires efficiently.

DDQ automation makes a team lean and powerful

Before security questionnaire automation

A proposal manager embarked on a self-improvement journey with due diligence questionnaires. Improvements in efficiency and accuracy were at the top of her list. To keep up with DDQ responses, she often hired consultants and writers for additional support. She wanted to keep her team “lean and mean” and scale capabilities, so she turned to security questionnaire software.

After security questionnaire automation

RFPIO allowed this team to drastically improve its DDQ response process. Flagging questions for review made content updates easy to assign to SMEs. Subject matter experts responded to DDQs with greater speed and accuracy, eliminating the need for outsourcing support. Contributors found clarity with their role in DDQ responses—together, this team became more powerful in their pursuit to win new business.

Schedule a demo of RFPIO to automate security questionnaires and transform your response process.

The secret to making security questionnaires a lot easier

Product & Best Practices

A security questionnaire is a document that organizations use to evaluate and validate security practices with third-party vendors before doing business with them. If you’ve noticed you’re spending more of your time responding to security questionnaires—that seem to have increased in both quantity and complexity—you’re not alone.

As large corporations spend more on cybersecurity, hackers have moved on to weaker targets: vendors and third parties. According to a 2016 study by Soha Systems, 63% of all data breaches can be attributed to a third party.

As a result, InfoSec and PreSales teams are responding to more and more security questionnaires, on top of your other responsibilities. You know this is not the best way to spend your time—especially since security questionnaires can be thousands of questions long, many of which are repetitive.

So what’s the secret to making security questionnaires a lot easier to handle? Having a content repository of responses, also known as an Content Library. And, the most efficient security questionnaire process possible depends on your Content Library setup.

Security questionnaires are the inescapable norm

You might spend your work days scheming ways to escape security questionnaire responses. Hate to be the one to break it to you, but you can’t.

If your product or service is in the realm of telecommunications, SaaS, internet, wireless, or information technology, responding to security questionnaires is the inescapable norm. These days there is no limit to the concerns people have over data and security. When you’re a tech company, those concerns are amplified.

In a recent Deloitte data security report, 70% revealed a moderate to high level of dependency on external vendors, with 47% reporting the occurrence of a risk incident involving external vendors over the past three years. And, 38% cited technology as their primary risk concern.

In other words, these vendor security assessments aren’t going anywhere. Because security questionnaires are a fact of life for you as a sales engineer, the smartest thing you can do is find ways to speed up that process. A more efficient process will take a lot of pressure off you and your sales team, allowing everyone to focus more on closing deals and achieving sales goals.

“We estimated it took roughly 16 hours to complete a security questionnaire, between finding the answer and typing the correct answer, as well as doing other tasks related to the job. Now with RFPIO, multiple people can collaborate on the same response—versus emailing questions back and forth. That has saved a lot of time and effort.” – Rob Solomon

How to effectively set up your Content Library as a unit

How you set up your Content Library totally depends on how your organization is structured. You might have a proposal manager, an entire team, or none of the above. No matter what your situation is, an effective Content Library setup is a joint effort.

Sales engineers tend to be more analytical than most, so you prefer systems over chaos. Categorizing your content repository properly is HUGE. Tagging responses within the Content Library are one of the best ways to organize some of the chaos.

Even when organizations have a response management platform like RFPIO, they don’t always succeed in maximizing the content repository. That’s because they don’t build out and organize their Content Library as a unit. Nobody owns this part of the content management, when really multiple people should…including you.

Let’s say you’re lucky enough to work with a dedicated proposal manager at your organization. They own RFPs and the response management platform, but they are not the experts in specific categories. Security responses can be particularly complex, which is why your proposal manager relies on subject matter experts who have a deep understanding of this information.

You and any other sales engineers involved in security questionnaires will share valuable input when categorizing and tagging security-related responses. If you are not involved in the Content Library setup, the proposal management team will likely categorize and tag the security Q&A pairs in a way that does not make sense to you.

Schedule a brainstorming meeting with your proposal management team to figure out which tags will be used within your Content Library. That way the system works for you, so you can respond to security questionnaires quickly and accurately.

Tagging content within your Content Library involves some administrative work. But it’s one of those tasks that you take care of in the beginning. Then you don’t have to worry about it moving forward.

Achieving security questionnaire efficiency

Building out an Content Library may seem like quite an undertaking upfront. But once this content repository is set up, it saves a tremendous amount of time for everyone involved in the response management process.

Sales engineers are a highly educated bunch that demand a significant salary. As one of the organization’s most valuable internal resources, protecting your time is important. Today a lot of your time is being spent answering those repetitive security questions instead of having the headspace you need to concentrate on closing deals.

With an easier security questionnaire process, you’ll free up your time to focus on key functions of your role and bring more sales effectiveness to your organization.

We’d love to show you how RFPIO makes your job way easier. Reach out and schedule a demo.

Use this security questionnaire template to win back time

Templates & guides

Ask someone who responds to security questionnaires how many questions they see, and they’ll casually reveal a number that’s somewhere in the realm of well over a thousand questions. Any vendor offering a SaaS solution will face the Standardized Information Gathering (Security Questionnaires) at some point. Depending on the version of the Security Questionnaires, it typically clocks in around a few hundred questions.

Today 97% of organizations use cloud services, according to McAfee’s Practical Guidance and the State of Cloud Security Report. With that widespread adoption comes more security questionnaires for SaaS vendors to respond to.

We speak from personal experience, because we are a SaaS vendor who has been in your shoes. We too must respond to security questionnaires constantly. In our world, a smaller security assessment will usually contain 250 questions, a mid-sized questionnaire will have 650, and the largest assessments have about 2500 questions.

security questionnaire template

The advantage for us—and for our clients—is that we leverage RFP software to overcome inefficiencies. Everyday we talk to organizations who struggle with a manual RFP response process when they can greatly improve productivity with an automated solution.

This month we released an exciting new feature that allows you to import Standardized Information Gathering (Security Questionnaires) with one click. Here is some information about RFPIO’s Security Questionnaires template import and how it will solve inefficiencies to help you win back time.

The first critical step in every RFP project is the import

A Security Questionnaires is a massive security and compliance questionnaire—figuring out where to begin can be an overwhelming task. When using RFP software, importing is the first and arguably most critical step, because it sets the tone for the entire project. If the import causes any friction, teams will spend time they don’t have to spare.

With intelligent RFP technology, an import is actually a time-savings opportunity for teams. That even applies to spreadsheets with thousands of questions. Based on your personal history with large scale vendor assessments, it’s likely difficult to imagine importing such a sizable spreadsheet into your RFP response automation solution quickly.

After enduring our own inefficiencies over the years, we found a way to load the information in one click with the Security Questionnaires template import. Long days in the office spent responding to our most recent Security Questionnaires pushed us over the edge, and inspired us to do something about it.

How the security questionnaire template solves inefficiencies

A Security Questionnaires is a very macro-heavy Excel, and traditionally it’s been a challenge to bring it into any automated RFP response solution. Excel macros are built into how the dependent questions come up and how the completion metric is calculated. Because you’re working with a standard template, you as the responder must answer the same questions repeatedly.

In other cases, standard questions might be seen as a good thing—but not with a Standardized Information Gathering Questionnaire. These security assessments are clearly exhausting for anyone tackling thousands of questions. No other RFP automation solution is currently in place that can solve this Security Questionnaires situation, and that leaves you searching for alternatives that are less than desirable.

One option is to hire interns as users to do a comparison and transpose the answers. Another option is to submit a previous version of a Security Questionnaires that you responded to, and see if the issuer will accept it. However, typically issuers add their own questions, and you might lose the deal because your responses aren’t up to snuff.

SIG template import

As you respond to a Security Questionnaires, RFPIO understands how the macro is programmed and works with your selection process. If you answer “yes,” it knows the dependencies and presents those 150 or so questions to you. If you answer “no,” it knows not to show irrelevant questions.

RFPIO goes through the Security Questionnaires on its own, to learn which questions need to come after which answers. RFPIO helps you take control of the most complex security assessments, because the technology is able to handle multiple levels of dependencies and then translate and automate that for you. The key is then being able to export your responses back into the original format, so you’re not having to do any work when you’re done in the application.

“Completing security questionnaires used to be an extremely time-consuming process for our team. RFPIO offers a one-click Security Questionnaires template import, in addition to auto-response and bulk answering features that promote speed and accuracy. What used to take days—or even weeks—now only takes us a couple of hours.” – Mandana Salehi, Director of Sales at Zapproved

Standardized information gathering questionnaires in one click

Now for the moment you’ve been waiting for…Standardized Information Gathering questionnaires can be imported into RFPIO with a single click. You upload the appropriate template (CAIQ, Security Questionnaires – Core, full, or lite). You can import directly from your local computer or cloud storage, such as: Google Drive, Dropbox, OneDrive, or Box.

From here, you can move on with your day, since the project’s primary contact receives an email notification once the import process is completed. Meanwhile, RFPIO configures questions, sections, and subsections on your behalf. Once the import is finished, it’s time for you to jump back into the project to review questions and sections.

This is where auto-response works its magic to populate your Security Questionnaires with the most relevant matches from your Content Library. The standardized nature of these questionnaires makes this response process very efficient through automation. You then customize as needed to ensure accuracy, or to add any necessary flourishes to wow that particular issuer.

Last, but certainly not least, you export everything back into the template of your choosing and send off to the issuer. Overall, less time will be spent on sizable vendor assessments so you can focus on other priorities.

There really is no need to dread the next massive Security Questionnaires that comes your way. With RFPIO’s Security Questionnaires template import, you and your team can use speed and accuracy to compete thousands of questions to land the deal.

Ready to take our Security Questionnaires template out for a spin? Schedule a demo to win back time.

See how it feels to respond with confidence

Why do 250,000+ users streamline their response process with RFPIO? Schedule a demo to find out.