Building a security answer library

The answer library is the asset. Tools and trust centres sit on top of it. Build it well once and every questionnaire after is matching, not writing.

Last reviewed 2026-09-30Written by Jacob Masse, TrazTech Inc.

A security answer library is a single, approved set of answers to the questions buyers ask, each tied to the evidence behind it, an owner and the date it was last confirmed. Build it from your last year of completed questionnaires and your SOC 2 or ISO 27001 evidence. It is what makes a trust centre, a SIG, a CAIQ and a custom spreadsheet consistent with each other.

What does a good answer library look like?

How do we build one?

1. Collect past answers. Every questionnaire from the last year, in one sheet.
2. Group by control area. Use the headings from your SOC 2 criteria or ISO 27001 Annex A so answers line up with your evidence.
3. Write one approved answer per question. Resolve contradictions. Where past answers differ, find out which is true.
4. Assign owners and review dates. An answer nobody owns goes stale.
5. Feed it back. Every new answer written for a buyer goes into the library before the questionnaire leaves.

How do we stop answers drifting?

Review the library when anything it depends on changes: a new report, a new subprocessor, a policy revision, an architecture change. Review it in full once a quarter. The drift that causes trouble is an answer that was true two years ago and was copied into five contracts since. Keeping a trust centre current uses the same calendar.

The thirty questions that appear in almost every questionnaire, with the evidence that answers each, are listed on security questionnaire help. They make a good first draft of a library.

Common questions