Security questionnaire help and ESG responses built on evidence your customer can check.

Under Drive™, yes: Sterling drafts every answer from your evidence and assembles the documents, and your owners review and approve before your organisation submits. Under Design™ your team drafts and we review. In neither model do we write an answer your evidence does not support, because the customer's reviewer can ask to see it, and an answer that fails that test costs more than an accurate partial one.

Say so, with what you do instead and when the gap will close. A disclosed gap with a compensating control and a dated plan is a normal answer; an unsupported yes that fails a follow-up question or a supplier audit undermines trust in the whole response. Where a gap can be closed properly before the deadline, we close it first and answer yes with the evidence.

Often a large part of it. Many questionnaires ask early on whether you hold one, and a current certificate with the right scope, or a SOC 2 report covering the right services and period, can answer whole sections. Customers still ask about points outside the certificate's scope or the report's criteria, so the rest is answered from your own evidence. We map both, question by question.

EcoVadis scores the response. The platform tailors its questionnaire to your size, industry and countries of operation, asks you to upload documents that support your answers, and its analysts rate your management system from 0 to 100 across environment, labour and human rights, ethics and sustainable procurement. The scorecard can then be shared with customers, so the evidence work matters as much as the wording.

With the request itself and the data you already hold. CDP runs an annual disclosure cycle and scores responses on climate change, forests and water security from D- to A, and a response submitted after the scoring deadline is received but not scored. Emissions questions need a greenhouse gas inventory; where you do not have one yet, we build it before drafting the response.

As long as your customer's deadline allows, and we plan backwards from it. A questionnaire answered mostly from existing certificates and records moves quickly; one that exposes missing policies takes longer, because those documents have to be written, approved and put into use before they count. A first EcoVadis rating or CDP response usually runs over several months. Share the deadline on the discovery call and we will tell you what is achievable.

Yes, and that is where most of the saving lies. Approved answers and the evidence behind them are kept in Effivity with an owner and a review date, so the next questionnaire starts from answers already checked. Evidence is refreshed before it goes out of date, and new questions are added to the library as customers ask them.

No. Your organisation signs and submits its own response and remains accountable for it. Sterling provides consulting, evidence preparation, software and training. Where a certificate, a SOC 2 report or a rating follows, an independent, accredited certification body, a licensed CPA firm or the rating platform assesses and decides, never Sterling.

When the same questions keep arriving from different customers. A certificate or report answers many of them at once and gives the reviewer something independent to rely on. After each response we compare what customers keep asking with what you can point to, and tell you whether ISO/IEC 27001, SOC 2, an EcoVadis rating or nothing at all is the right next step, and why.