Security questionnaires finished from your evidence.
Atteston helps teams upload evidence, draft CAIQ-style answer candidates, inspect available source anchors, and export approved answers.
What Atteston does
Upload evidence
Start with SOC 2 reports, policies, pentest summaries, security overviews, and other approved evidence.
Review answer candidates
Draft CAIQ-style candidates from uploaded evidence and inspect available source anchors before export.
Supported scope first
Launch support covers CAIQ v4 / CSA STAR, AI-CAIQ, HECVAT, VSAQ, and other parseable .xlsx and .xlsm questionnaire workbooks, plus UTF-8 CSV and TSV files, with uploadable evidence. SIG workbooks run as Assisted Beta.
Sample demo
Sample replay: evidence-backed CAIQ answer flow
A static replay of real product states: sample evidence, answer candidates with source anchors, evidence checks, unanswered rows, reviewer approval, and workbook-safe export readiness. A live demo is not yet available.
Are processes, procedures, and technical measures defined, implemented, and evaluated for periodic, independent, third-party penetration testing?
A reviewer approved this evidence-backed draft.
Draft answer
Yes. An independent, qualified third party performs penetration testing at least annually. Findings are tracked in the vulnerability management program and remediated against documented timelines.
Citation
Independent third-party penetration testing runs at least annually.
“…an independent, qualified third party performs penetration testing of production systems at least annually; findings are remediated according to documented severity timelines…”
Are cryptography, encryption, and key management policies and procedures established, documented, approved, communicated, applied, evaluated, and maintained?
Evidence-backed draft is ready for reviewer confirmation.
Draft answer
Yes. The encryption and key management policy covers data at rest (AES-256) and data in transit (TLS 1.2+), with documented key rotation and an annual policy review cycle.
Citation
Encryption and key management policy is documented and reviewed annually.
“…data at rest is encrypted with AES-256 and data in transit with TLS 1.2 or higher; cryptographic keys rotate on a documented schedule reviewed annually…”
Are access control records retained periodically, as deemed appropriate by the organization?
Not found in the sources searched.
No admissible evidence was found in the sources searched. The reviewer answers it or adds evidence.
Are policies and procedures for security incident management, e-discovery, and cloud forensics established, documented, approved, communicated, applied, evaluated, and maintained?
No usable draft is available yet.
The reviewer saves a manual answer or requests internal owner input. The row stays visibly unanswered until then; nothing is exported silently.
Export readiness
Workbook-safe export unlocks after reviewer approval. Unsupported formats, missing evidence, and owner-input waits stay marked clearly instead of hidden.
Is Atteston a fit?
Atteston is built for teams where
- Inbound security questionnaires arrive as Excel workbooks — CAIQ and CAIQ-style formats first.
- You already hold evidence: SOC 2 reports, security policies, pentest summaries, past answers.
- Reviewers need visible source support and a clear Needs you, To confirm, or Ready to review group for every question before export.
A compliance suite is a better fit if
- You need a trust center, portal coverage, and company-wide GRC tooling.
- You are building your compliance program from scratch, without evidence documents to draw from.
- You want one vendor to manage the program and the questionnaires.
Already on Vanta, Drata, Secureframe, or another compliance platform? Those products can include questionnaire automation within a broader compliance suite. Atteston is a focused option for teams that want a dedicated evidence-to-review-to-Excel workflow. Read the comparison.
Why not the alternatives?
Copy-paste from the last one
Free, familiar, and where most teams start. But answers drift out of sync with your current evidence, formatting breaks, and nothing records who approved what.
A chat window
Depending on plan and configuration, ChatGPT can cite connected sources, retain project context, and edit spreadsheets. Atteston adds a questionnaire-specific review, approval, provenance, and workbook-drift workflow.
A compliance suite
Vanta, Drata, Secureframe, and similar suites can include questionnaire automation alongside broader compliance and trust-center tooling. Atteston is a focused option for evidence-backed Excel questionnaire work.
Built to be checked
Evidence review
Available source anchors are shown in review. A question with no admissible evidence, or one that waits for input the owner must give, is grouped Needs you.
Human approval
Exports use approved answer versions and preserve the reviewer decision.
Tenant isolation
Row-level security scoped to your account, enforced in the database.
Audit ledger
The append-only audit ledger defines event types for questionnaire jobs, approvals, and exports.