Kevin Yun

Build the library from questionnaires you've already completed, not from scratch. Here's the extraction, the governance, and how to stop it going stale.

Posted by Kevin Yun | 2026-08-16T07:34:47.254Z

An answer is a claim; evidence is what makes it checkable. Here are the six kinds of proof reviewers request, and what you should never send.

Posted by Kevin Yun | 2026-08-16T07:32:20.966Z

A first questionnaire usually takes two to three weeks of part-time work. The second takes a fraction. Here's where the time actually goes, and why.

Posted by Kevin Yun | 2026-08-15T06:06:23.230Z

Ownership belongs with whoever is accountable for the deal, not whoever knows the most about security. Here's the split, and where each model breaks.

Posted by Kevin Yun | 2026-08-15T06:04:29.976Z

The questionnaire rarely arrives alone. Here are the nine documents that travel with it, why buyers want each, and what to send when you don't have one.

Posted by Kevin Yun | 2026-08-14T13:15:57.200Z

The SIG is broad third-party risk and costs money to license. The CAIQ is deep on cloud and is free and publishable. Most SaaS vendors meet both.

Posted by Kevin Yun | 2026-08-14T13:14:21.341Z

The tier of SIG you receive tells you how a buyer categorised your risk. Here's how to identify which one landed and what it means for effort and stakes.

Posted by Kevin Yun | 2026-08-13T08:43:12.685Z

Most of a security questionnaire is documentation work, not security work. Here's how to split it so your engineers spend two hours instead of two weeks.

Posted by Kevin Yun | 2026-08-13T08:40:42.594Z

The template that helps a SaaS vendor is not a blank questionnaire. It's a structured answer bank organised by topic, so the next assessment is retrieval.

Posted by Kevin Yun | 2026-08-12T09:03:08.706Z