Plain definition
What a cited first draft is
A first draft of the security spreadsheet a buyer sent you, filled only from documents you already have. Every yes has a citation. Every unsupported row stays missing.
What it is
A buyer sent a SIG, CAIQ, HECVAT, or custom questionnaire. You already have some of the files they are asking about — a SOC 2, policies, architecture notes, past answers.
You pay $499. You upload those files. You get the spreadsheet back with an answer and a citation on every row the uploaded documents support. Rows they do not support are listed as missing, plus the artifact that would close them.
You review every cell. You own the answers. You send the file.
What it is not
- A pass or a certification
- A promise the buyer will accept it
- Invented controls or filled-in gaps
- Someone signing as your security officer
- Someone submitting the file for you
- Someone logging into your systems
A yes that is not in a document you uploaded is not a yes. We do not certify, verify, or promise a pass.
Price
$499 one time, tax included. You pay first. Stripe then opens the upload page. There is no free upload.