The Paperwork Desk

Send Me the Questionnaire. You Approve the Answers.

When a customer sends a security questionnaire, the person who knows your systems best loses hours to it, and the deal waits days. I draft the answers from material you've already approved and send them back in 3 business days. You read, edit and approve every answer before it goes to your customer.

I also keep compliance evidence current each month (compliance upkeep) and write up new vendors for you (vendor reviews).

Questionnaires · $600 each

Security Questionnaires, Drafted for Your Sign-Off

Why These Eat Time

  1. 1.
    More than 90% of companies take at least two to three days to finish one.Source: Whistic, 2024 TPRM Impact Report.
  2. 2.
    They land on whoever knows your systems best. Often that's an engineer or a founder who should be doing something else.
  3. 3.
    The deal waits while they're being answered.

How It Works

  1. 01 Send it. Send the questionnaire and anything you've already approved: past answers, your security page, your policies.
  2. 02 I draft. Each answer notes where it came from. If your material doesn't cover a question, I mark it for you instead of guessing.
  3. 03 You approve. You edit, approve and send it to your customer yourself. Your approved answers come back to you, ready for the next one.

Price

$600 per questionnaire, up to 200 questions, back in 3 business days. More than 200 gets a quote before work starts.

Compliance upkeep · Monthly

Keep Your Security Evidence Current All Year

If your customers hold you to a security standard, the work doesn't stop after the yearly review. For a flat monthly fee I keep your evidence calendar, chase the recurring items, and keep your controls written down and dated. Your outside assessor still does the review. I make sure the evidence is there when they ask.

Why This Eats Time

  1. 1.
    The recurring items never stop. Access checks, policy reviews, training records and vendor lists all come due on their own dates.
  2. 2.
    When nobody owns the calendar, it all piles up before the review. Then the people who know your systems lose weeks catching up.

How It Works

  1. 01 Map it. A 45-minute call and a look at your current tool, tracker or spreadsheet. I build a calendar of every recurring item, each with an owner and a due date.
  2. 02 Keep it moving. Each month I send the requests, collect what comes back, file it where your assessor expects it, and flag anything late or missing.
  3. 03 Stay ready. A one-page status and a short call each month. Before your outside review, you get an evidence index and a list of open gaps.

Price

$1,500 a month, flat, month to month. Covers up to 40 recurring items. More than 40 gets a quote before I start.

Vendor reviews · Per review or monthly

Vendor Security Reviews, Written Up for Your Call

Every new tool that touches your data needs someone to read the vendor's security answers and decide if the risk is acceptable. I read what the vendor sent and send you a two-page write-up with the gaps, follow-up questions and a suggested risk level. You make the call.

Why These Pile Up

  1. 1.
    Every vendor sends something different. Questionnaire answers, a security page, policies, an outside report. Someone has to read all of it.
  2. 2.
    Many need follow-up questions. Then you wait on the answers, and the review sits open.

How It Works

  1. 01 Send the vendor. Its name, what it will touch, and whatever it sent you: questionnaire answers, its security page, any outside report.
  2. 02 I write it up. Two pages: the data and access the vendor gets, what its documents show, the gaps, follow-up questions and a suggested risk level.
  3. 03 You decide. Approve, approve with conditions, or pass. Send the follow-up questions when you're ready.

Price

$400 per review, or $1,200 a month for up to 4. Each one comes back within 5 business days. The monthly plan includes reading the vendor's follow-up answers.

Say hello

Have Something Waiting?

Leave your name, work email and which service you're asking about. I'll reply by email within one business day.

I'll only use what you send through this form to reply to you. You won't get a newsletter unless you ask for one, and I never sell or share your details. If I emailed you first, I got your work address from a business contact list I pay for, and replying "remove" to that email takes you off it.

Questions

Who does the work?
I do. I'm Tim Williams, and I've worked on almost 100 healthcare and SaaS engagements. This is a one-person service, so every draft and write-up comes from me.
Who's responsible for what goes out?
You are. I draft and suggest. You approve every answer, make every vendor call, and send everything yourself. I don't sign, vouch for or submit anything on your behalf.
What if your material doesn't cover a question?
I mark it open and note what your customer is likely asking for. You decide how to answer. I won't write in a control you don't have.
Do you do the review or certify us?
No. Your outside assessor or auditor does the review and signs off. I keep the evidence and controls current so you're ready when they ask.
Do we have to drop our compliance software?
No. I work in whatever you use now: the software, a shared drive or a spreadsheet.
Do you need access to our systems?
I don't need admin access. You send what I need, or give me view-only access to the tracker you already use.
What if a vendor won't send anything?
I review what's public, like its security page and published policies, mark the write-up as based on public information, and list what to ask for.
What happens to our documents?
They're used only for your work, and I read every line myself before it reaches you. When you stop, I delete your files within 30 days and confirm by email.