Product
Upload evidence, review answer candidates and available source anchors, then export approved answers
Atteston is a security questionnaire workspace. You bring two things: the evidence documents you already maintain, and the Excel questionnaire a customer sent you. The self-serve workflow starts with those uploads and keeps evidence review, answer approval, and workbook export in one place.
From evidence to reviewed workbook
1Upload your evidence
Start with the documents you already have: SOC 2 reports, security policies, pentest summaries, architecture overviews, and past questionnaire answers. Atteston extracts citable passages tied to source locations so reviewers can inspect the available evidence behind a candidate.
2Upload the questionnaire
Upload the Excel workbook your customer sent. Atteston parses the questions, detects the answer cells, and classifies the workbook before you rely on it. CAIQ v4 / CSA STAR, AI-CAIQ, HECVAT, VSAQ, and other parseable .xlsx and .xlsm workbooks, plus UTF-8 CSV and TSV files, are the supported launch scope. SIG workbooks get clearly labeled best-effort assistance (Assisted Beta), and unsupported files are flagged honestly instead of half-processed.
3Review candidates by the attention they need
A draft from your documents with admissible citations to current evidence appears as Ready to review or To confirm and waits for a person's approval. An approved answer whose evidence changed afterwards is grouped Needs you and marked Needs review again. A question with no admissible evidence is grouped Needs you and shown as not found in the sources searched. When resolved source anchors are available, reviewers can open them and confirm the support.
4Approve before anything ships
Generated candidates pass through the review workspace before export. Accept, edit, or reject each candidate and inspect any available source evidence. Exports use approved answer versions; approval activity has a dedicated audit event type and durable reviewer-action record.
5Export back to the original workbook
Answers are written into the workbook your customer sent — not a lookalike template. The engine writes only your approved answers and their associated explanation and ownership or maturity fields. For workbooks with formulas, it may also update a setting that requests recalculation when the file opens. An automated drift check compares the export against the original and flags unexpected structural changes instead of shipping them silently.
What the review looks like
Sample replay: evidence-backed CAIQ answer flow
A static replay of real product states: sample evidence, answer candidates with source anchors, evidence checks, unanswered rows, reviewer approval, and workbook-safe export readiness. A live demo is not yet available.
Are processes, procedures, and technical measures defined, implemented, and evaluated for periodic, independent, third-party penetration testing?
A reviewer approved this evidence-backed draft.
Draft answer
Yes. An independent, qualified third party performs penetration testing at least annually. Findings are tracked in the vulnerability management program and remediated against documented timelines.
Citation
Independent third-party penetration testing runs at least annually.
“…an independent, qualified third party performs penetration testing of production systems at least annually; findings are remediated according to documented severity timelines…”
Are cryptography, encryption, and key management policies and procedures established, documented, approved, communicated, applied, evaluated, and maintained?
Evidence-backed draft is ready for reviewer confirmation.
Draft answer
Yes. The encryption and key management policy covers data at rest (AES-256) and data in transit (TLS 1.2+), with documented key rotation and an annual policy review cycle.
Citation
Encryption and key management policy is documented and reviewed annually.
“…data at rest is encrypted with AES-256 and data in transit with TLS 1.2 or higher; cryptographic keys rotate on a documented schedule reviewed annually…”
Are access control records retained periodically, as deemed appropriate by the organization?
Not found in the sources searched.
No admissible evidence was found in the sources searched. The reviewer answers it or adds evidence.
Are policies and procedures for security incident management, e-discovery, and cloud forensics established, documented, approved, communicated, applied, evaluated, and maintained?
No usable draft is available yet.
The reviewer saves a manual answer or requests internal owner input. The row stays visibly unanswered until then; nothing is exported silently.
Export readiness
Workbook-safe export unlocks after reviewer approval. Unsupported formats, missing evidence, and owner-input waits stay marked clearly instead of hidden.
Supported scope, stated plainly
Format support is classified honestly instead of marketed broadly. If your workbook uses features not listed here, contact us and we will tell you whether we can handle it.
| Feature | Status | Detail |
|---|---|---|
| CAIQ v4 / CSA STAR CAIQ-style .xlsx workbooks | Supported | The full launch workflow: upload, draft, review, export, and value evidence. |
| VSAQ workbooks (any layout) | Supported | VSAQ workbooks, in the canonical Google layout or a modified one, run the full upload, draft, review, and export workflow. |
| Other parseable .xlsx / .xlsm workbooks (including HECVAT and AI-CAIQ) | Supported | The full upload, draft, review, and export workflow. SIG workbooks are the Assisted Beta exception: clearly labeled best-effort assistance, excluded from performance-promise language. |
| Formulas | Protected | Detected and skipped. Cells containing formulas are never overwritten. |
| Protected sheets | Respected | Answers are written to unprotected cells only. |
| Merged cells | Handled | Anchor-cell redirect logic writes to the correct cell. |
| Dropdowns / data validation | Matched | Answers are selected from the available options, including alias matching (y → yes, n → no). |
| Macros (VBA) | Not fully verified | Preservation is not yet verified across workbook variants. Contact us before relying on it. |
| Embedded images and drawings | Not fully verified | Preservation depends on workbook structure. Contact us to discuss your specific file. |
| Word or PDF questionnaires | Not supported | Not an answer target. PDF documents remain usable as source evidence. |
| Portal-based questionnaires | Not supported | On the roadmap. If portals are your main bottleneck, Atteston is not the right tool yet. |
When something is not right, you hear about it
The evidence is insufficient
A question with no admissible evidence is grouped Needs you and shown as not found in the sources searched. A question that waits for input the owner must give is grouped Needs you as well.
Some workbook features require a scope check
Launch classification identifies unsupported file and workbook-family scope before processing. It does not preflight every embedded workbook feature; contact us before relying on macros, images, charts, or other embedded objects.
An export contains unexpected structural changes
The automated drift check compares the export against the original workbook and flags the difference.
Unsupported evidence and unexpected workbook changes require attention. Atteston surfaces those states so a reviewer can decide what to do next.
Works alongside your compliance stack
Vanta, Drata, Secureframe, and similar platforms can include questionnaire automation within broader compliance and trust-center suites. Atteston does not replace that program. It is a focused option for teams that want a dedicated workflow for reviewing evidence-backed candidates and returning supported Excel questionnaires. Read the comparison.