Security Questionnaire Panic Checker

What is a security questionnaire actually asking for?

Most vendor security questionnaires cover the same eight areas in different words. This checker sorts each line you paste into one of those areas by keyword, shows how the questions are distributed, lists the evidence a reviewer will want for each area, and flags the answers that are dangerous to guess at.

How this calculator works

Each pasted line is matched against 134 fixed keyword and regular-expression patterns grouped into eight control areas — audit evidence, access control, encryption, incident response, vendor management, privacy and data handling, business continuity, and change management — and filed under the single area whose patterns it matched most. It is deterministic pattern matching, not a language model, and it reads the questionnaire rather than your controls.

Because a line is filed under exactly one area, a question spanning two areas is counted once. And any line containing a trigger word is counted, including a section header, a cover page, or a line from an answer column. The number reported is a count of lines kept, not a count of questions.

Lines that match nothing are not discarded silently — they are listed back, so a real control question in an unusual phrasing can still be spotted. There is no category for risk assessment, personnel security, training, governance or physical security, so questions on those subjects land in that unmatched list rather than in a control area.

Urgency is scored from what you enter alongside the paste: whether a live deal depends on it, how far away the customer's deadline is, whether SOC 2 is being asked for and what you hold today, how many areas the questionnaire covers, who sent it, and your headcount. It is a reading of the situation you described, not of your control environment. If nothing in the paste matched a control area at all, a high score is capped at medium, because urgency built on text the checker could not read would be a false alarm.

The evidence list and the likely gaps are fixed text per area, not findings about your company. Every company pasting an access-control question receives the same access-control gap. The weights that rank those gaps are the practitioner judgement of the auditors who wrote them; no measured exception-rate dataset sits behind them.

A worked example

An eight-question vendor security review arrives from a prospect, tied to a live deal, with a deadline two weeks out and no SOC 2 report in hand. Run on 10 September 2026.

Six of the twelve urgency points came from the dropdown answers rather than the paste: three for the live deal, three for the fourteen-day deadline with one more for it being under two weeks, three for a SOC 2 request with no report, one for breadth and one for a prospect asking. Worth noticing what happened to the first line — the document's own title, “Vendor Security Review — Northwind Logistics”, was filed as a vendor-management question because it contains the word vendor. That is the matcher working exactly as designed, and it is why the distribution is a rough shape rather than a precise count.

Common questions

Does this use AI to read my questionnaire?

No. It runs 134 fixed keyword and regular-expression patterns and files each line under whichever area matched most. It cannot tell a question from an answer, or a heading from either, and the tool labels itself rule-based for exactly that reason.

Does anything I paste get sent anywhere?

The analysis runs entirely in your browser and the questionnaire text never leaves it — the text is not included even when you request the PDF. Requesting the PDF does send the summary, the area counts and your contact details, so the report can be emailed to you.

Why does it say “questions read” when some of those lines are not questions?

The number counts lines kept after noise is stripped, which includes headings, instructions, and any answers already filled in. Read it as how much text was sorted, rather than as a count of questions asked.

Do the eight areas match the SOC 2 Trust Services Criteria?

No. They are this tool's own grouping of what vendor questionnaires tend to ask about, and they do not map onto the criteria one to one. There is no category for risk assessment, personnel security, training, governance or physical security.

Are the likely gaps findings about my company?

No. They are fixed paragraphs attached to whichever areas the questionnaire covered, ranked by the auditors' judgement of where first-year exceptions usually appear. The tool never sees a control of yours and cannot know what you already hold.