If you have ever submitted a new tool to your procurement team for vendor security review, you have seen the questionnaire. Depending on the organization, it is somewhere between 50 and 250 questions covering encryption, access control, incident response, data retention, business continuity, and a dozen other domains.
Most engineers approach this questionnaire as an obstacle. The better approach is to understand what it is actually asking — because when you understand the underlying questions, you realize that most of them can be answered systematically rather than laboriously.
The Four Questions Under Every VSQ
Every vendor security questionnaire — regardless of its length or framework, whether CAIQ, SIG, NIST CSF, or CSA — is ultimately asking four questions.
Where does my data go and how is it protected? Who can access it and how do I know? What happens if something goes wrong? Can I verify what you're telling me?
The 200 individual questions are different ways of asking these four questions across different domains and trust service criteria.
Data Location and Protection
Questions about encryption at rest and in transit, data residency, data classification, backup procedures, and retention all map to the first question. For an internal tool running on certified infrastructure, many of these answers come from the infrastructure provider's documentation rather than from the tool itself.
Access Control and Identity
Questions about multi-factor authentication, privileged access management, user provisioning and deprovisioning, SSO integration, and role-based access control all map to the second question. The answers depend on the identity architecture of your deployment platform and the tool's own access controls.
What Inherited Compliance Changes
When your tool runs on ARX, which runs on Aptible's SOC 2 Type II certified infrastructure, the verification questions have answers. The SOC 2 report exists. The audit logs exist. The penetration testing was performed on the infrastructure your tool runs on.
ARX's compliance package generator maps your tool's actual runtime behavior to each of these question categories and generates pre-filled answers. The questionnaire that took three months to complete manually takes an afternoon. The six-month vendor review becomes a two-week procurement approval.
That is the compliance gap. ARX closes it.