Your CISO is the bottleneck, and the questions repeat with different wording. Answers are drafted from your policies, certificates and incident records, each citing its page and version, and when no document supports the answer, we help you write it rather than inventing one.
A security questionnaire is an assessment sent by a client, prospect or auditor to verify how a supplier protects information. It covers governance, access control, encryption, subcontractors, business continuity and incident handling, and expects documented evidence behind each answer.
Definition as used on this page. See the glossary.
“Your environment” means your private instance, whichever deployment mode applies: SaaS, private cloud or on-premise.
The scene
With Optivalue.ai
1 / 7
Security policies, certificates, penetration test attestations, subcontractor register, continuity plan, incident records. Files stay where they are; the index lives in your private instance.
2 / 7
The librarian agent knows which version of each policy is in force and keeps the superseded ones, which is what prevents quoting a withdrawn control.
3 / 7
Multi-tab Excel, Word form, standard market questionnaire or assessment portal via the browser extension. The original formatting is preserved.
4 / 7
Each answer is drafted from your evidence with document, page and version. Questions that need the CISO personally are isolated, so a specialist reviews ten items rather than one hundred and eighty.
5 / 7
Seven anti-hallucination checks, a 0-to-100 score per answer, and a gap analysis that flags missing, contradictory or out-of-date evidence, before the client’s auditor finds it.
6 / 7
Where a policy or procedure does not exist, the gap is declared, an owner named, and the document co-written from your existing material. How that works.
How that works7 / 7
The CISO approves by name, and the workbook returns in its original formatting with the evidence pack assembled alongside.
The difference
We wrote the policies and produced the evidence for large groups under audit. That practice is trained into 72 function agents, 12 sector agents and a librarian, so an ISO or DORA question is handled by an agent that knows what evidence it demands.
How it worksSource, page, version, score, approver, timestamp, reconstructable when the client audits you next year, which is exactly what an assessor asks for first.
The anatomy of a defensible answerPenetration test findings and incident records are the most sensitive documents you own. Private instance, never shared, jurisdiction of your choice, on-premise available with air-gap support.
Sovereignty in detailNew versions of standards and national transpositions change what assessors expect. Optivalue Watch monitors 193 jurisdictions and updates the assessment grids.
The ecosystemA general-purpose assistant is fine for an internal summary of a policy. The line is the signature: an assessment returned to a client, whose answers their auditor will test, needs source, version, score and a named approver.
Frequently asked
Every claim must trace to a passage in an indexed document of yours, and seven verification checks run before an answer is shown. Where no source exists, the platform declares a gap instead of producing plausible text.
The gap is declared, an expert is named, and the missing document can be drafted with you from your existing material. See missing documents.
No. The platform works on the documents you already have, policies, certificates, records, wherever they live. The repository builds itself as answers are approved.
Questions referencing ISO/IEC 27001, NIS2, DORA, GDPR and the standard market questionnaires are handled by the security agents. We prepare your answers and evidence; we do not certify or attest compliance.
That is the design. The CISO reviews low scores, detected commitments and anything new, then approves by name. Named human sign-off cannot be switched off.
In your private instance, never shared, in the jurisdiction you choose, with on-premise and air-gap available. Processing as well as storage. See sovereignty.
We run it in front of you, on your documents, in your environment. You will see which answers your evidence supports, and which documents you are missing.
