The Method

What the desk does with a questionnaire in five business days, who reviews it, how the page counts it, and what the same work costs elsewhere.

Last updated 9 October 2026.

Five business days

1. Day 0Payment, then intake. The order page opens an upload step for the questionnaire and the evidence behind the answers: an information security policy, a SOC 2 or ISO 27001 report, a pen test letter. Up to 10 files of 25 MB each. The clock starts when the last file arrives.
2. Day 1Recount and read. The desk counts the questionnaire again against the page's count and reads every document sent. A recount that lands in the other tier is settled before any drafting starts.
3. Days 2 to 4Drafting. Each answer is drafted from the evidence and cites the document and section it rests on. Where the documents say nothing, the answer says so, and the question goes on a list of what to write first.
4. Day 5Review and return. A named reviewer reads each answer against the document it cites and initials it: [[REVIEWER NAME NEEDED]]. The questionnaire comes back in its own file format, with the answer bank as CSV and Markdown.

Business days run Monday to Friday. Public holidays are not in the calendar, so a week with one in it can land a day later than the stamp says.

The desk takes [[CAPACITY NEEDED]] questionnaires a week.

The count

The count runs in the buyer's browser, with no server and no model. The page opens .xlsx and .docx files by unzipping them with the browser's own decompression and reads .csv files as text. Then it applies three rules to every row, in order.

1. A sheet named as instructions, a scoring or analyst sheet, a list of dropdown values, or a hidden sheet is read for its rows and never counted for questions.
2. A row of two or more cells, one of them a short label containing question, control, requirement or criteria, is a header. Its columns become question columns.
3. A row is a question when a cell ends with a question mark, when its first cell is a question ID (A&A-01.1 in a CAIQ, HFIH-01 in a HECVAT, A.1 in a SIG, or Q12), or when it holds four or more words in a question column. A lone cell in Title Case is a section heading and is skipped.

Each question goes to one domain: the first in a fixed list, from access control to people and HR, whose keyword it contains. A question that matches none is counted as Other. The framework is named from the IDs and the headers. The tier comes from the count: up to 150 questions is $590 and 151 to 400 is $990. The server recomputes the tier and the price from the count before checkout opens, so the browser never names a price.

Rules miss. A four-word section heading written in sentence case can count as a question, and a question written as a statement, with no ID and no question column, can be missed. That is why the desk recounts at intake.

The rules are tested against four files with their counts fixed before the tests first ran: a CAIQ-shaped CSV with 24 questions, a HECVAT-shaped workbook with 29, a Word table with 3 and a packing list with none. The HECVAT-shaped workbook copies the header layout of EDUCAUSE's HECVAT Lite with questions of our own writing, because EDUCAUSE's download did not answer when this page was built.

Frameworks and their owners

The prospect holds the SIG licence and sends the questionnaire. The desk answers the copy the prospect sent and never passes the SIG on. The desk is affiliated with none of these owners; they are named so you know which questionnaire you hold.

What a draft needs

A draft is only as good as the policies and reports behind it. Every answer cites a document, so an answer with nothing to cite is not written up as if it had one. A vendor with no written policies gets a shorter questionnaire back, the unanswerable questions marked as such, and a list of what to write first, in the order the questionnaire asked for it.

A shorter honest answer beats a long one the evidence cannot carry.

Where the desk stands

The price of a questionnaire is a count, and the count belongs on the page before anyone talks to you. A quote that needs a meeting is a quote you cannot plan around.

Answers belong to the vendor, as files. The answer bank leaves with the draft, as a CSV and a Markdown file, so nobody holds your answers inside a platform to keep you paying for access to them.

What the work costs elsewhere

Software that answers questionnaires is usually a different purchase: a subscription, an answer library kept inside it, and your own team reviewing what it drafts. The desk sells one reviewed draft at a time.