Stratum Tech Group · Katy, TX
Your security policies and questionnaire answers, written around the tools you really use.
For small software companies and IT providers who just got a security questionnaire from a bigger customer. Answer about 20 questions. Get a starting set of security policies, a gap list with dates, and draft answers to the questions customers ask most, as a Word file and a printable page.
Delivered on screen right after checkout. 14-day refund if it does not fit your company.
What you get
Policies with your tools in them
Your cloud, identity provider, password manager, code host or RMM, backups and vendors are named in the policies, so they read like yours, not a blank template.Questionnaire answer sheet
Draft answers to the questions buyers ask most in SIG Lite and CAIQ-style questionnaires, each pointing at the policy that backs it.Gap list with dates
Anything you do not do yet (MFA everywhere, tested backups, disk encryption, training) becomes a dated action, so your policies describe what you really do.Aligned to known frameworks
Each policy maps to CIS Controls v8.1, NIST CSF 2.0 and the SOC 2 Trust Services Criteria, which makes a later SOC 2 or ISO project easier. Aligned, not certified.Two kits
Starter
- 6 core policies: Information Security, Acceptable Use, Access Control, Incident Response, Backup and Recovery, Vendor Management
- 15-question answer sheet
- Gap list, approval page, staff acknowledgment
- Word file and printable page
Full
- All 14 policies: the Starter six plus Device Security, Data Classification and Retention, Encryption, Secure Development (or Client Environment Access for IT providers), Change Management, Logging and Vulnerability Management, HR Security and Training, Risk Assessment
- 40-question answer sheet, also as a CSV for spreadsheets
- Risk register and access review record
For comparison
How it works
- Answer about 20 questions about your company and tools (about 10 minutes).
- Pick Starter or Full and pay through Stripe checkout.
- Your kit opens on screen. Download the Word file, fix anything that does not match how you work, sign the approval page and work through the gap list.
- Use the answer sheet as your starting point the next time a customer sends a questionnaire. Check every answer before you send it.
Questions
Does this make us SOC 2 or ISO 27001 compliant?
No. SOC 2 is an audit report from a CPA firm and ISO 27001 is a certification from an accredited body; no document can give you either. This kit gives you the written policies those programs expect you to have, aligned to their criteria, as a starting point.
Can we send the answer sheet straight to a customer?
Check every answer first. The answers are drafts built only from what you told us, and answers marked Yes assume you follow the policies. A wrong answer on a security questionnaire can breach a contract.
Is this legal advice?
No. Stratum Tech Group is an IT company, not a law firm. If a contract or regulation depends on these policies, have a qualified professional review them.
We are an IT provider (MSP). Does it fit us?
Yes. Choose "IT provider" in the form and the kit swaps the Secure Development policy for a Client Environment Access policy covering RMM tools, client credentials and client separation.
Can I edit it?
Yes. The Word file is yours to edit. Review it each year; the kit sets your next review date.
What do you do with my answers?
We use them only to build your kit. We never sell them. See terms and privacy.