Security Questionnaire Prep: 22 Questions in Buyer Order, With the Artifact for Each
A buyer's security review is more predictable than the founders losing deals to it think. Across 10+ auditor and GRC sources, roughly 60 raw question instances deduplicate to 22 canonical questions (auditor FAQ corpus), and they arrive in a consistent arc: inventory, ownership, access, trail, approvals, versions, incident reconstruction. The pattern stalling deals is the absence of an answer, not the difficulty of the question. One reply on r/AI_Agents named it: "agents that pass a technical eval and then stall for months at security review because nobody can answer 'what can this agent do and who approved it.' Capability gets you the demo. Governance gets you the contract."
For the seller on the receiving end of that review, this is the compliance checklist rearranged into the order a buyer's security team actually asks its questions, with the evidence artifact to attach to each answer. The buyer-side version of the same 22 questions is the auditor questions page.
The whole questionnaire reduces to three questions
Vanta's distillation of what auditors want is three questions: "Can you explain what your AI systems do?", "Can you show how access and decisions are controlled?", "Can you provide evidence that oversight is consistent?" The 22 canonical questions are elaboration on those three. Memorize the three, rehearse the 22.
Two distribution facts shape your prep:
- Audit trail, most-asked. It appears in six or more canonical questions and in every source organization, and "show me the trail for a specific decision" is the universal move.
- Isolation, least-asked. Essentially only AIUC-1's Q2-2026 update raises execution-environment sandboxing explicitly. A seller who leads with isolation evidence is ahead of the questionnaire, not behind it.
Speak SOC 2 first, then introduce ISO 42001. Founders ask "is there anything similar to SOC 2 but specifically for AI compliance?" (r/TheFounders, where nobody in the thread knew the name ISO 42001). Your buyer's security engineer mostly speaks SOC 2 too. Name SOC 2 first and introduce ISO 42001 as the answer to that exact question.
The prep sheet: questions in buyer order
Each row pairs the canonical question, who reports buyers and auditors asking it, and the checklist line plus the artifact that answers it. "Reported by" links go to the published question lists.
| # | The buyer asks | Reported by | Answer from the checklist, and the artifact to attach |
|---|---|---|---|
| 1 | What AI agents do you run, where do they run, and what can each connect to? | Vanta, A-LIGN, Kognitos | One isolated environment per task, built from versioned images, regionally placed. Artifact: the environment inventory with image versions and placement regions. |
| 2 | Who is accountable when an agent acts autonomously? | Schellman, Vanta, ISACA | Every AI action runs under a distinct AI identity bound to the human who initiated the task. Artifact: one real PR showing the AI author and the bound human. |
| 3 | Is every privileged action attributable to a verifiable identity? | Teleport, AIUC-1 A003.3 | Same line, enforced per session. Teleport's warning is the one to pre-empt: auditors "treat 'no human request' as a major accountability gap." Artifact: the identity record on a privileged action. |
| 4 | How do you know what code was AI-generated? | Vendor AI-code corpus (directional; no major audit firm has published on this yet) | Human-authored and AI-authored are always distinguishable in the record, by identity, not by a trailer policy engineers can strip. Artifact: git history filtered by the AI identity. |
| 5 | Show me the audit trail for one specific decision: inputs, trigger, action, reviewer. | Kognitos, Vanta, Teleport, ISACA | A durable, external, append-only log of prompt, actions, review, tests, merge, queryable by task, actor, and time. Artifact: a full session replay for one real task. This is the most-asked question in the corpus; rehearse it. |
| 6 | Are those logs tamper-evident and complete across the whole audit period? | Teleport, AIUC-1 | The log is append-only and lives outside the sandbox, so it survives environment destruction. Artifact: retention configuration plus sampled records spanning 12 months (Type II sampling). |
| 7 | Is each boundary enforced by a technical constraint or an instruction? | A-LIGN ("build fences, not rules") | Credentials never enter the environment where model-generated code runs; access is per-task scoped; registry access is deny-by-default. Artifact: a recorded failed attempt. An agent that tried and was refused is worth more than a policy PDF. |
| 8 | Which actions require human approval before they take effect? Show the decision-authority matrix. | Kognitos, Vanta, Deloitte | The author of a change is never its sole approver; required human gates are enforced and recorded. Artifact: the workflow definition plus a task parked at a gate. |
| 9 | Can you prove review was substantive, not a rubber stamp? | Kognitos, KPMG | Review decisions carry reviewer, timestamp, and scope; large changes are refused rather than approved. Artifact: a recorded rejection that looped a task back. |
| 10 | What version of the agent ran on date X, and what was it capable of? | A-LIGN ("retrievable for any date"), Kognitos, ISACA | Environments are reproducible from versioned images; the image version is pinned in every task record. Artifact: any task record from six months ago. |
| 11 | After an incident, can you reconstruct what the agent did and why? | A-LIGN, Kognitos, Teleport | Replay the session log. Artifact: a tabletop reconstruction of one past task, end to end. |
| 12 | Are execution environments sandboxed; are tools and MCP servers approved, authenticated, and logged? | AIUC-1 Q2-2026 B006, B008, D003 | One isolated VM per task; tool calls mediated and logged with server-level metadata. Few buyers ask this today; the ones who do are reading AIUC-1, so answer in its terms. |
"Evidence, not policies" is the grading rubric
The buyer's security engineer has already concluded that policy text is theater; the only answer that scores is a system record. Vanta's ninth and final item is literally "evidence, not policies." The skepticism behind it is on the record: a widely upvoted HN comment on human review calls it "CYA then anything else, 'Why yes SOC2 auditor, we review all PRs'". Assume the person grading your questionnaire has read that thread and believes it.
The practical consequence: for every row above, the artifact column is the answer and the prose is decoration. A system with the seven properties produces these artifacts as a byproduct of normal operation, which is the whole argument of evidence as a byproduct. If producing an artifact requires a special export project, the buyer will read that correctly.
Five questions the architecture will not answer
Five of the 22 canonical questions have no structural answer, and pretending otherwise reads as evasion. The auditor questions page flags the same five. Fence them in your responses:
- Complete inventory. The properties govern an agent once known; nothing forces discovery of unknown agents. Answer with process: registration, footprint reviews.
- Behavioral drift. A-LIGN's test is "if one of your agents started behaving differently today, who would notice, and how quickly?" That is monitoring, not architecture.
- Risk and impact assessments. Governance paperwork that auditors sample regardless of architecture.
- Adversarial testing. Isolation bounds the blast radius; it does not answer "what testing do you do against prompt injection and jailbreaks?" The benchmark here is Intercom's AIUC-1 audit: 50+ controls and quarterly adversarial testing "across 1,000+ scenarios."
- Your own vendor due diligence. The buyer will ask how you manage your third parties, model providers, and dynamically discovered tools. Dependency provenance answers the package slice; the rest is TPRM paperwork with an owner.
Certificates open doors; they do not close deals
Hold the certifications, name them in the order the buyer knows them, and never let a certificate stand in for an artifact. Community framework mentions run SOC 2 first by a wide margin, then HIPAA and GDPR, with ISO 42001 near zero outside GRC circles. And the practitioners who hold ISO 42001 rate it bluntly: the engineer who got a 50-60 person SaaS certified called the experience "honestly, kinda underwhelming", another in the same thread called it "cool on a sticker for the marketing department," and a third conceded "it's the bare minimum. Which really has to make you think when there are companies that can't get it."
So the certificate is table stakes and the table above is the differentiator. For where the questionnaire goes next, read Schellman's ISO 42001 FAQ (their clients' top question is how to consolidate frameworks into a single audit; see one audit, many frameworks) and the AIUC-1 Q2-2026 controls: cryptographically verifiable agent identities, just-in-time permissions, agent-to-agent message signing, and MCP tool-call logging.