Respond with confidence, not guesses — every answer is evidence-cited and reviewer-approved. See how

Security questionnaire automation

Your deals shouldn't wait on security reviews.

Upload the questionnaire your customer sent. Mardyn drafts from approved evidence, cites every source, flags unsupported claims, and keeps a human reviewer in control before export.

Monday, 27 July

Good morning, Sarah

Acme Corp · SIG Lite 0 / 184 drafted

Draft the Acme SIG Lite What expires this quarter? Gaps vs. ISO 27001

Needs your approval

Encryption at rest AI draft · Acme Corp soc2-typeii-2026.pdf · p.14

Sub-processor list AI draft · Acme Corp dpa-schedule-3.docx · p.2

Incident response SLA AI draft · Acme Corp ir-runbook-v4.pdf · p.7

Review 12 answers

Evidence expiring

Pen test report Expires in 9 days

SOC 2 bridge letter Expires in 24 days

This week

Acme SIG Lite sent 184 answers · all approved

Q3 access review Closed Thursday

On track

Mardyn Security Questionnaire.xlsx Questionnaire automation 0 of 125 drafted 6 need review

#QuestionDraft answerSourceStatus

44 Do you maintain audit logs of administrative access? Yes — administrative access is logged and retained for 12 months. Logging & Monitoring §5.4 —

45 Is multi-factor authentication enforced? Yes — MFA is required for all user accounts. Access Control §3.2 —

46 Is there a documented incident response plan? Yes — the incident response plan is reviewed and tested annually. Incident Response Plan §1.1 —

47 How are vulnerabilities identified and managed? Yes — quarterly vulnerability scans and continuous monitoring are used across production systems. Vulnerability Management §2.6 —

48 Is a business continuity plan in place? Yes — continuity plans are tested annually and after material changes. Business Continuity §3.1 —

49 Do you conduct third-party risk assessments? Approved policy found; operating evidence is still required. TPRM Standard §4.1 —

50 Are security awareness trainings conducted regularly? Yes — every employee completes security awareness training at least annually. Security Awareness §1.2 —

On question 49 Discussion

! Operating evidence required No approved evidence verifies that third-party assessments are performed on a defined cadence.

ML Morgan LeeGRC analyst · now @Jordan, we found the approved TPRM policy, but we don't have evidence confirming the assessment cadence or that the process is operating. Can you confirm whether suppliers are assessed before onboarding and reassessed based on criticality? Please attach the latest completed vendor-assessment register or review report.

JK Jordan KimTPRM owner · now Yes. Critical suppliers are assessed before onboarding, annually, and after material changes. Medium-risk suppliers are reassessed every two years. I've attached the Q2 2026 Third-Party Risk Review Register.

PDF Q2 2026 Third-Party Risk Review Register.pdf 1.8 MB · supplied by Jordan Kim Security scanning

Approved by Morgan Lee · GRC Admin

Draft pass complete 119 answers are ready for human review

Works with the questionnaires and controls your team already receives.

SSIG / SIG Lite

CCAIQ

VVSA / DDQ

XCustom XLSX

Illustrative questionnaire timeline

See where the 30 minutes go.

Mardyn automates intake, evidence matching, and handoffs so reviewers spend their time on supported decisions—not document assembly.

<30 min Received to ready-to-send

Routine workflow after evidence setup. Timing varies with questionnaire complexity, evidence coverage, and reviewer availability.

01Questionnaire received0:00
02Drafted from approved evidence0:03
03Reviewed and approved0:19
04Ready to send0:27

Before there is a system

The answers exist. Finding them is the work.

Policies live in one folder, prior answers in another, and the context behind each claim lives with the person who last reviewed it. The team spends its time reconstructing the trail.

Disconnected evidence Repeated expert follow-up Approval history spread across files

Two colleagues tracing connections across a wall of scattered policies and questionnaire documents

Review every answer. Spend your time on the exceptions.

Mardyn turns approved policies, reports, and prior responses into a reusable answer library. Every answer stays visible for review, while gaps and unsupported claims are clearly flagged for closer attention.

The old handoff

Every questionnaire starts from zero.

1Search old spreadsheets and message threadsManual

2Reconfirm the same claims with expertsBlocked

3Rewrite answers in the customer's formatRepeated

4Track approvals in another documentFragile

The Mardyn handoff

Approved knowledge moves with the work.

✓Map each question to current evidenceCited

✓Draft only what the source supportsGrounded

✓Route gaps and exceptions to a reviewerControlled

✓Return the original customer formatReady

Your team reviews what changed.Not every cell.

One connected workflow

The file, the evidence, and the reviewer stay connected.

Each handoff carries the source material and decision context forward, so the finished response can be traced back to what your organization has actually approved.

Customer fileQuestionnaire receivedXLSX · 106 questions
Evidence matchApproved sources mappedPolicies · audits · prior answers
Exception routingUnsupported claims flaggedOwner assigned · no guessing
Reviewer controlEvery answer checkedDecision and source set recorded
Customer-readyOriginal file preparedReviewed · cited · ready to send

One traceable path Received → grounded → reviewed → ready

The review workspace

Know exactly what is safe to send.

Every proposed answer carries its source, evidence state, and reviewer decision. Missing or stale support is surfaced before export—not after a customer challenges the response.

Run a pilot with your questionnaire

Question 41 of 106

CUSTOMER QUESTIONNAIREDoes production access require MFA?

✓ Evidence-backed answer

Drafted from three approved sources

Production access requires SSO, enforced MFA, role approval, and quarterly access review. The draft stays linked to the current source material.

Access Control Policy §4.2 SOC 2 CC6.1 Review log A-104

Automation with clear controls

Move faster without lowering the review standard.

Mardyn prepares source-backed responses and routes unsupported claims to the right reviewer. Nothing becomes approved until an authorized person signs off.

Draft from approved evidence

Responses stay tied to current policies, reports, and previously vetted answers.

Route unsupported claims

Missing or stale support is assigned for review instead of being completed with unverified language.

Record reviewer decisions

Approval, reopening, export, and evidence changes remain attributable and auditable.

Automated draftAnswer prepared from approved evidence

Three source passages are attached. The draft remains unapproved and cannot be exported.

Reviewer decision requiredApprove this response?

Production access requires SSO, MFA, role approval, and a quarterly access review.

3 sources cited · current

Audit eventAnswer approved by L. Lang

Decision, source set, timestamp, and exported version are retained for traceability.

Bring the file they sent

See your next questionnaire start mostly done.

Run a guided pilot with one real customer questionnaire and your approved evidence. See what Mardyn can answer, what needs review, and how the finished file returns to your customer.

Run a pilot Replay the demo