I worked at places that sent out these things, despite them being silly, answer them truthfully and keep your answers. Perhaps make a standard response as far as possible so its easy to get through.
Its a bit silly in the sense they will ask for example for ISO and SOC accreditations and then subsequently go ask about lots of stuff that is covered by those same certifications.
If you struggle on this and there is money on the line, and its a common theme, maybe get someone in to answer them.
Often someone who works on compliance in your org will do. So that person who got you the SOC2 acreditation or evidences it or same for ISO.
You can also get a consultant to help you answer them ofc. A small MSSP might have someone not tooo expensive to help u through the questions.
If you have noone who does these things then you wont be ISOxxxx compliant or have that SOC2 thing... which you will need to solve first anyhow, that person, they can help :)..
I worked at places that sent out these things, despite them being silly, answer them truthfully and keep your answers. Perhaps make a standard response as far as possible so its easy to get through.
Its a bit silly in the sense they will ask for example for ISO and SOC accreditations and then subsequently go ask about lots of stuff that is covered by those same certifications.
If you struggle on this and there is money on the line, and its a common theme, maybe get someone in to answer them.
Often someone who works on compliance in your org will do. So that person who got you the SOC2 acreditation or evidences it or same for ISO.
You can also get a consultant to help you answer them ofc. A small MSSP might have someone not tooo expensive to help u through the questions.
If you have noone who does these things then you wont be ISOxxxx compliant or have that SOC2 thing... which you will need to solve first anyhow, that person, they can help :)..