Your review starts when the file is complete

Most of what lands in your inbox is not opinion. EDUCAUSE publishes the questionnaire that a lot of large institutions send, with Internet2 and REN-ISAC, and version 4.1.6 of it runs to 332 distinct questions. Of those, 85 ask the supplier to provide, attach or reference a document rather than tick yes or no. Seven of them, DOCU-01 to DOCU-07, name the document they want. So the honest description of a security review is not an interrogation. It is a request for a folder, and the folder either exists on the day it is asked for or it gets written while your date slips. Here is how those 332 questions are distributed by scope.

Two more sets sit behind a trigger. Twenty-nine questions fire when health data is in scope and twelve when cardholder data is, so an engagement that touches either is answering a longer questionnaire than the one it was quoted against.

Two institutions publish their own clocks, and they are worth reading separately rather than as a category average.

UC Berkeley's sentence carries a clause most people skip. The four to six weeks run "starting from the date the Vendor has provided all the information requested". Before that date there is no clock at all, only email. UC Davis targets four weeks and separately tells the people inside its own organisation to submit at least three months before they need an answer, which is the gap between a target and a calendar. UC Davis also names what stretches it: how many requests arrive at once against the budget cycle, how long the NDA takes to negotiate, and submissions that come in incomplete. Read those three together and the picture is plain. Your assessor's queue is theirs, your NDA is shared, and the completeness of the file belongs to your supplier. That is the part anyone can actually move, and it is why we start by asking what your review will ask for.

Nine functions read this file: your sponsor, procurement, vendor risk, an outsourced assessor where one is appointed, legal, privacy, the architecture review board, insurance and risk, and a CISO exception path. UC Berkeley publishes the exception route on its own service page, so a finding does not end the engagement, it routes it. Three things we bring on day one: our NDA, so that negotiation is not on your critical path; architecture and data-flow diagrams; and the TRS, which is the document your compliance team reads for design intent. The rest of that list is what your review asks for, and we answer it in your file rather than pointing at a badge. UC Berkeley also publishes the flip side. If the vendor is not responsive to the assessor, the assessment is delayed, and that is the failure mode we plan against.

Say it plainly, because you will have to repeat it upward. We hold no SOC 2, no GDPR certification and no HIPAA certification. What we do is engineer systems that pass your audits, and write the design intent down where your compliance team can check it. If your engagement genuinely requires a certified supplier, we will tell you that in the first conversation and point you somewhere else.

ISO is blunt about the first row: it does not perform certification or issue certificates, so nobody is certified by ISO. An external certification body issues the certificate. The second row matters more. ISO says conformity with 27001 means a system to manage risk is in place, which is a management system rather than a statement about any piece of software. ISO also says outright that implementing 27001 and certifying against it are separate choices. On the SOC 2 column, the AICPA's own journal notes that compliance is a term never used in SOC 2 examinations, and that a report is restricted to specified parties who already understand the system. A badge on a website is not that report. What we send you is the fourth column, and it is the file: the TRS, the diagrams, and answers written against your questionnaire.

Your security team did not get stricter for sport. Verizon's annual breach report counts how often a third party was involved in a confirmed data breach, and that share has moved across three consecutive editions.

Read the denominator carefully, because it is what makes the number usable in your own meeting. This is confirmed breaches, not incidents and not organisations, and Verizon's measure covers three different ways a third party can be in the story. One figure from the 2026 edition sharpens it. Where cloud MFA credentials were exposed through a third party, 23 percent of those third parties fully remediated, out of 7,513 cases. So the question your review is really asking is not whether a supplier can be a risk. It is what the supplier does once something is found.

One question catches most suppliers flat: who else touches this system. Published guidance asks a supplier to help facilitate assessments of the fourth parties it significantly relies on. The UK government's own survey shows how unevenly organisations do this today, and how much further the large ones go.

Both series are UK survey figures about organisations in general, and neither is a result of ours. The useful part is the gap between the two bars in every size band. Far fewer organisations look past the supplier they signed with than look at the supplier itself, which is exactly the gap the newer questionnaires are written to close. If your review reaches that far, expect the question, and expect it to arrive late, after the schedule is already set.

The question that usually comes from one level up is why not give this to the firm you already have an MSA with. It is a fair question, and the honest answer is that an existing MSA transfers risk, it does not add capability. The review still happens, it just happens to a name procurement already knows.

We do not name clients, and that stays true regardless of who has given permission, so nothing above is a logo you can look up. What you can do instead is talk to people. References are available when you are ready to verify, and that is a better test than a story we control the telling of.

Your organisation has a spend level above which IT approval, comparison shopping, legal review and a security assessment all fire at once. If this crosses that level, you are buying the review as well as the build. If it does not, say so on the form and we will tell you that in one reply rather than over six weeks. Nobody in this category prints a price, and we are not going to invent one. What we can do is show you the shape, so you can size it yourself. Buy discovery on its own, first and bounded. It ends with the BRD, FRD, SRS and TRS set, and those are the same documents your architecture review board and your assessor will ask for. That is the whole argument of this conversation: the documents that price the build are the documents your review opens with.

Send us the scope and the list of gates you have to clear and we will size discovery against it. The form gets you a conversation with a technical person, not a quote and not a proposal deck.