Intent Data Security Questionnaire: Scope, Control Owners and Evidence

The short answer: build an evidence ledger before answering the spreadsheet

Create one row per questionnaire item with these fields:

• question and requirement;
• system and environment in scope;
• personal, confidential, or client data involved;
• responsible organization and named control owner;
• answer: yes, partial, no, not applicable, or unknown;
• short explanation;
• evidence artifact and evidence owner;
• coverage and report period;
• exception, compensating control, or remediation;
• reviewer and approval status; and
• next review or material-change trigger.

The goal is not to finish quickly. It is to give procurement an answer that remains accurate when quoted alone and can be defended with evidence.

Map the service into five control layers

1. BrandWell platform layer

Identify the portal, reports, APIs, workflows, authentication, access, logging, storage, exports, support access, retention, deletion, incident handling, and business-continuity features included in the contracted scope. Obtain the current DPA, subprocessor list, security overview, incident terms, and any available independent assurance directly from BrandWell.

Public terms are useful for contractual orientation, but they are not a security audit. If a report, certificate, penetration test, or recovery test is not available, say so and describe the evidence that is available.

2. Underlying data-source layer

Request documentation of the sources and responsibilities applicable to the actual service. Record permitted use, fields, refresh, correction, deletion and suppression responsibilities. Do not infer an upstream provider or data architecture from a marketing description.

3. Cloud and subprocessor layer

List hosting, authentication, observability, support, messaging, analytics, and integration providers that process in-scope data. Record location, purpose, data type, contract, assurance, access, retention, deletion, incident notification, and replacement/change process.

4. Agency control layer

The agency owns its staff access, endpoints, passwords or SSO configuration, client isolation, exports, custom workflows, CRM credentials, internal retention, support procedures, incident escalation, and end-client contracts. A vendor control cannot cover an agency laptop, spreadsheet export, or misconfigured automation.

5. End-client and activation layer

The client may control website notices, consent or opt-out, CRM roles, seller access, ad platforms, suppression lists, outreach content, campaign approval, and data-subject requests. State client dependencies explicitly. A secure platform cannot make an unlawful or deceptive activation safe.

A 12-step workflow for completing the questionnaire

1. Freeze scope and architecture

Record the service name, tenant/client boundary, modules, integrations, regions, user types, data categories, environments, and data-flow diagram. Reject questions that silently mix the whole vendor company with the specific service.

2. Classify data and purpose

Separate topic/account signals, person or business contact data, website events, credentials, client lists, reports, CRM outcomes, support data, logs, and billing data. State why each category is needed.

3. Assign a RACI

The agency security owner is accountable for the final response. Product/engineering, privacy/legal, operations, the platform vendor, and the end client provide evidence for their layers. Procurement should know who can approve exceptions.

4. Build the evidence room

Use a restricted repository with versioned artifacts: architecture, policies, training records, access reviews, vulnerability management, secure development, test summaries, incident plan, recovery tests, DPA, subprocessor list, deletion procedure, insurance, and contract exhibits. Keep sensitive audit or test reports under controlled access.

5. Normalize the questionnaire

Map duplicate buyer wording into a control library. The Cloud Security Alliance CAIQ is a useful cloud-control question set. A CAIQ response is a self-assessment, not an audit or certification.

6. Answer with scope qualifiers

Use formulations such as:

• “Yes, for production portal access; evidence is the access-control policy and sampled review.”
• “Partial: platform data is encrypted, while agency exports require a separate endpoint control.”
• “Not applicable: the agency does not develop or distribute executable software.”
• “No: the control is not implemented; this compensating control and remediation plan apply.”

Avoid “industry standard” without naming the control and evidence.

7. Validate external assurance precisely

The AICPA Trust Services Criteria support examinations over security, availability, processing integrity, confidentiality, and privacy. Say “SOC 2 examination” or “SOC 2 report,” not “SOC 2 certified.” Record Type I or Type II, period, system scope, subservice treatment, exceptions, and bridge coverage.

ISO/IEC 27001 specifies information-security management system requirements. Implementation and certification are different. If certification is claimed, verify the certificate, legal entity, scope, certification body, and validity.

8. Review privacy and contract roles

Map processing roles, jurisdictions, purposes, retention and onward sharing with the qualified privacy reviewer. Determine the applicable contract and request-handling duties for the actual flow instead of copying a generic legal clause.

9. Test the operational truth

Sample user access, terminated users, client isolation, exports, deletion, incident contacts, backup restoration, workflow permissions, logs, and support access. A policy without operating evidence is incomplete.

10. Record gaps and decisions

Classify gaps by likelihood, impact, client requirement, workaround, owner, cost, and due point. Some gaps block launch; some are contractual exceptions; others need buyer acceptance.

11. Obtain independent approval

Security, privacy/legal, and the business owner should approve the final response. Sales should not alter the answer to close the deal. Track exactly what was sent and any oral clarification.

12. Refresh on material change

Update the answer pack after significant architecture, subprocessor, data-category, geography, incident, certification, policy, or product changes. A once-completed questionnaire should not become permanent boilerplate.

The NIST cybersecurity supply-chain quick-start guide supports defining supplier requirements and risk-management responsibilities. Use it as guidance for the review, not evidence that a particular supplier meets those requirements.

Criteria for reviewing intent-data providers for procurement

Apply the same criteria to each provider:

1. Scope clarity: service, tenant, data, regions, dependencies, and shared responsibility.
2. Assurance: policies, control evidence, independent reports/certificates, exceptions, and periods.
3. Data governance: source categories, roles, permitted use, minimization, retention, deletion, requests, and client isolation.
4. Security operations: access, encryption, development, vulnerability management, logging, incident response, recovery, and subprocessors.
5. Agency delivery: white-label rights, client accounts, exports, workflows, support, and end-client responsibility.
6. Commercial readiness: security-pack availability, response ownership, contract terms, SLA, and implementation burden.
7. Best fit and limitation: the procurement context each option may suit and the evidence gap the buyer must resolve.

Confirm the actual MarketPulse service scope

Identify the portal, reports, APIs, workflows, authentication, access, logging, storage, exports, support access, retention, deletion, incident handling, and business-continuity features included in the contracted scope. Obtain the current DPA, subprocessor list, security overview, incident terms, and any available independent assurance directly from BrandWell.

Public terms are useful for contractual orientation, but they are not a security audit. If a report, certificate, penetration test, or recovery test is not available, say so and describe the evidence that is available.

Build, resell, or use a managed security-response service

Custom build: maximum control, but the agency owns architecture, secure development, testing, uptime, incident response, privacy engineering, and evidence. Use it only with sustained specialist capacity.

Reseller platform: faster time to market and clearer vendor evidence boundaries, but the agency still owns configuration, exports, clients, staff, workflows, and claims. Contractual shared responsibility must match operational truth.

Managed security-response support: useful when questionnaires are frequent and complex. The outside specialist can organize evidence and clarify wording, but should not invent controls or answer legal questions without the responsible owner.

Direct client-vendor procurement: useful when a large client’s security team needs a direct contract and audit rights. The agency can still operate the program, but its white-label economics and control may change.

Price questionnaire work without hiding the procurement cost

Treat initial security readiness as setup work: architecture, data inventory, role mapping, evidence room, control library, contract review, remediation, and baseline response pack. Ongoing work includes access review, subprocessor changes, policy updates, incident exercises, assurance renewal, questionnaires, client meetings, and remediation tracking.

Price a defined number and complexity of questionnaires, response SLA, evidence-call hours, and update cadence. Exclude legal opinions, audit fees, penetration tests, certifications, material remediation, and bespoke client controls unless specifically scoped. Gross margin depends on reusable evidence quality and exception volume; there is no universal target.

A good program protects revenue by reducing avoidable procurement delay and false answers. Do not promise that it increases win rate. Measure completion time, clarification rounds, unanswered items, exceptions, remediation age, security-related deal delays, and renewals that pass the gate.

Use an evidence-quality ladder

Not every artifact supports the same strength of answer. A policy shows intended practice. A screenshot or configuration export shows one implementation point. A ticket, access-review sample, recovery-test result, or log shows operation. An independent report or certificate provides assurance only for its stated system, period, criteria, and exclusions. A contract defines obligations but does not prove performance. Label the evidence type in the ledger and choose wording that matches it. If a buyer asks whether a control is “audited,” a policy and a self-assessment are not substitutes. When strong evidence is unavailable, provide the truthful current answer, a compensating control if one exists, and the owner and decision for remediation.

Intent-data-specific questions buyers often miss

• What creates a topic signal, and at what identity level?
• Which sources, fields, geographies, and sensitive categories are included or excluded?
• How is a person or account match expressed, and what accuracy limitations apply?
• Can the agency or client export raw or derived records?
• Which uses – CRM, advertising, outreach, research, enrichment – are permitted?
• How are opt-outs, deletion, disputes, and suppression propagated?
• Are client records used to train or improve models, and under what terms?
• How are tenant isolation and support access tested?
• Which agent or automation can read data or take action?
• What approvals, logs, stop conditions, and rollback paths exist?
• What happens at contract termination?
• Do not assume topic exclusivity; verify any separately negotiated right in its governing agreement.

What a recurring agency security package should include

Offer a maintained control-and-evidence service, not one completed spreadsheet:

• scoped architecture and data-flow diagram;
• control and evidence ledger;
• shared-responsibility matrix;
• approved answer library;
• DPA, subprocessor, retention, and incident register;
• access and client-isolation reviews;
• workflow permission and approval review;
• quarterly evidence refresh;
• questionnaire response SLA;
• exception and remediation log;
• buyer clarification calls; and
• annual or material-change reassessment.

The package can sit alongside the white-label intent service, but the agency should not mark up security claims as sales copy. Procurement evidence must stay accurate even when it makes the offer less convenient.

To review the intended delivery model before completing a questionnaire, Compare MarketPulse plans and document which controls belong to BrandWell, the agency, and the end client.

An evidence-led answer example

Illustrative questionnaire item: “Are former employees removed from all client systems?” The answer should identify which systems the agency controls and the evidence reviewed. A written offboarding policy alone does not establish that every account was actually revoked.

A scoped response might say: “The agency has an offboarding procedure for the systems listed in this response. The attached sample records the accounts checked, revocation status and reviewer. The client administers the separate CRM access listed as a dependency.” Use that wording only when the evidence supports it.

If one account remains unresolved, report the gap, owner and next action. Do not convert a partial result into an unqualified yes.

Measure response work without inventing assurance

Fictional response pack: Of 100 questions, 60 have current supporting evidence, 20 have partial evidence, 10 remain unknown and 10 are not applicable. Among 90 applicable questions, current-evidence coverage is about 66.7%. That is not a compliance score, audit opinion or guarantee of procurement acceptance.

If preparation takes 12 hours at an assumed $60 hourly cost plus $180 of allocated tooling, listed preparation cost is $900. Additional review, remediation, audit or legal work is separate. Treat these as planning assumptions, not market rates.

Separate security evidence from software entitlements

The checklist covers proposed agency and client controls, not a claim that every listed feature is included in MarketPulse. Verify authentication options, logs, support access, retention, deletion, API access, client workspaces and assurance documents directly for the selected scope.

A subscription alone does not establish a white-label portal, independent certification, protected topics or a complete security-response service. Keep the software package and any agency-delivered evidence work separate in the proposal.

Frequently asked questions

Should an agency offer security-questionnaire support?

Yes, when it operates the white-label service and can maintain evidence across vendor, agency, and client layers. Promise an accurate, organized response process – not guaranteed approval.

What workflow, staffing, SLA, and handoff are required?

Use a security owner, privacy/legal reviewer, platform contact, agency operations owner, client contact, and executive exception approver. Freeze scope, collect evidence, answer, review, approve, transmit, and log follow-ups under a complexity-based SLA.

Which providers best support procurement?

Choose the provider whose current evidence, shared-responsibility model, data governance, agency rights, and system scope match the client. Never rank by a security badge alone.

How do build, reseller, and managed approaches compare?

Build provides control with the highest assurance burden. Reselling accelerates delivery but preserves agency responsibilities. Managed support organizes evidence; it does not transfer control ownership or legal accountability.

How much should the agency charge?

Separate readiness setup from recurring maintenance and per-questionnaire work. Price complexity, evidence gaps, meetings, remediation, and SLA. Do not include audits, tests, certifications, or legal opinions unless scoped.

How should an agency prove revenue impact?

Measure procurement cycle time, clarification rounds, security-caused delay, exceptions, remediation, renewals, and lost deals. These are operational associations, not proof that the questionnaire service caused revenue.

Which clients are the best fit?

B2B data, SaaS, enterprise, regulated, and procurement-heavy clients with defined owners and evidence needs fit well. Clients demanding unsupported “yes” answers or blanket compliance claims should be excluded.

Which signal and workflow questions matter most?

Ask about source, identity level, fields, geography, permitted use, retention, deletion, exports, agent access, approvals, logs, and downstream systems. Intent data’s origin and activation are part of security scope.

What are the biggest risks?

Scope confusion, copied answers, stale evidence, questionnaire-as-certification language, hidden subprocessors, uncontrolled exports, weak client isolation, vague incidents, and sales overrides are major risks.

What should a recurring package include?

Maintain architecture, evidence, roles, approved answers, vendor changes, access reviews, workflow controls, exceptions, remediation, and client responses. Refresh it after material change, not only at renewal.