RFPRelay · Free evidence diagnostic

Find the evidence gaps a questionnaire tool cannot make true for you

For a first or occasional enterprise security review, mark only evidence you can support today. This diagnostic runs locally in your browser; selections are not uploaded.

Current evidence pack

Security ownership — named security contact and escalation owner.Access control — current policy plus evidence for MFA, privileged access and joiner/mover/leaver controls.Incident response — current plan, escalation path and evidence the process is maintained or tested.Data handling — encryption, retention/deletion, subprocessors and data-location facts appropriate to the product.Vulnerability management — policy plus recent evidence of scanning, remediation or patch handling.Resilience — backup/recovery approach and current evidence for restore or continuity controls.Assurance artifacts — only current reports, certifications or assessments whose scope actually covers the claim.

Route every material answer through four fields

Answer: current fact in plain language.
Evidence: document, control, report, configuration or record that supports it.
Owner: function accountable for validating it.
Gap: unknown, partial, planned or not-applicable instead of polished certainty.

Escalate before answering when

the buyer asks for a certification, audit scope or control that is not clearly evidenced;
the answer could create a contractual, privacy, security, architecture or delivery commitment;
prior answers conflict with current product behavior or policy;
the evidence is stale, restricted or outside the scope of the claim.

Request a fit check for one current diligence event

Operational guidance only. This is not legal advice, an audit, a certification or a guarantee that a buyer will accept any answer.