An enterprise prospect likes the product. Procurement is fine with the pricing. Then their security team sends a long questionnaire, and the deal stops until it comes back. If you run on AWS, much of the AWS-side evidence may already exist in your account. The work is knowing which artifact answers which question, and finding out — before your customer does — which controls are actually off.
What reviewers actually ask
The questionnaire might be a SIG Lite, a CAIQ, or a homegrown spreadsheet, but the questions often cluster into five areas:
- Encryption — data at rest and in transit
- Access control — who can touch production, and how
- Logging and audit trail — can you reconstruct what happened
- Backup and recovery — can you restore, and have you proven it
- Vendor management — who your providers are and how you vet them
Take them one at a time.
Encryption at rest and in transit
At rest, start with three common places. EBS default encryption is a per-region account setting — check it, because it only applies to volumes created after you turn it on. AWS has encrypted new S3 uploads with SSE-S3 by default since January 2023, but reviewers often ask about customer-managed keys, so know which buckets use SSE-KMS and why. RDS encryption is set at instance creation and shows up plainly in describe-db-instances.
In transit: ACM-issued certificates on your load balancers and CloudFront distributions, a modern TLS security policy on each listener, and — for the strong answer — S3 bucket policies that deny requests without aws:SecureTransport.
Good evidence here is AWS Config managed rules such as encrypted-volumes and rds-storage-encrypted, exported as a compliance report. Config output can provide broader evidence than a single console screenshot because it reports the resources evaluated by the rule; check each rule's scope and supported resource types.
Access control
Reviewers commonly ask three things: is MFA enforced, is access individual, and is it least-privilege.
- The IAM credential report is one API call and provides evidence for IAM users: password status and age, access-key age, and MFA status. If it shows a 700-day-old access key, fix that before you attach the report.
- IAM Identity Center tied to your identity provider can support joiner/leaver controls when identity lifecycle provisioning and deprovisioning are configured and tested.
- IAM Access Analyzer external-access findings show what is shared outside your account. Zero unexplained findings is an answer you can attach.
- The root account gets its own question. The right answer: MFA on, no access keys, used only for tasks that require it.
Logging and audit trail
CloudTrail console event history keeps 90 days of management events. That alone is not a durable audit trail. A stronger pattern is a multi-region trail delivering to S3, log file validation enabled so you can detect alteration, and a retention period that matches the policy stated in your questionnaire.
Two adjacent gaps to check: CloudWatch Logs groups with no retention policy (they default to never-expire, which sounds fine until the question is "what is your retention policy" and the honest answer is "accidental"), and GuardDuty findings that route to nowhere. Detection nobody reads does not count as monitoring.
Backup and recovery
"We have snapshots" is not a backup answer. The strong version is an AWS Backup plan: defined schedule, defined retention, backups in a vault, and a tested restore with a date on it. AWS Backup restore testing can automate periodic restore evaluation; even one documented manual restore beats an untested pile of snapshots. State RPO and RTO figures your configuration actually delivers, not the ones you would like.
Vendor management
For an AWS-hosted product, AWS is a key infrastructure provider, and AWS Artifact is one evidence source: self-service access to AWS compliance reports and certificates, subject to each artifact's access and use terms. Be careful with the shared responsibility model — AWS's audits cover the cloud itself. Pasting the AWS SOC 2 report as if it covered your application can undermine the rest of the questionnaire.
Closing the usual gaps fast
In a small estate, some gaps may be bounded changes:
- Turn on EBS default encryption in every region you use.
- Create or repair the multi-region CloudTrail with log file validation.
- Set retention on every CloudWatch Logs group.
- Enforce MFA and delete the stale access keys the credential report surfaced.
- Run one restore test and write down what happened.
Others take weeks, and the answer should say so. Encrypting an existing unencrypted RDS instance is not a checkbox — it is snapshot, copy-with-encryption, restore, and a cutover window. Unwinding years of over-broad IAM policies is a project, not a task.
True beats aspirational
Security questionnaires get attached to contracts. Your answers become representations you have made to a customer, and they resurface at the worst possible moment — after an incident, during renewal, in front of their auditor. A documented "partial — remediation scheduled for Q4" is a fine answer. A "yes" you cannot evidence is a liability. The test for every row: if the reviewer replies "show me," can you? If not, fix the control or fix the answer.
Facing a questionnaire right now? A scoped Consulting engagement can address IAM, network exposure, audit trail, and the remediation behind defensible answers. Or book your free AWS assessment to talk through where you stand.