Enterprise Security Questionnaire Review

Template Overview

Enterprise sales deals stall or accelerate based on the rigor of the vendor security review. The Enterprise Security Questionnaire Review template equips sales engineers, account executives, and security architects to document prospect compliance requirements, record verified technical responses, and overcome enterprise infosec objections in plain Markdown.

Markdown Template Structure

Copy the block below or click Download .md File to add this template directly to your personal vault:

---
title: "Security Questionnaire Review: [Prospect Organization]"
date: [YYYY-MM-DD]
prospect: "[Prospect Name]"
lead_sales_engineer: "[[Sales Engineer Name]]"
prospect_ciso: "[[Prospect CISO / SecOps Lead]]"
contract_potential: "$[ACV] ARR"
security_status: "In Review / Cleared / Exceptions Documented"
tags: [sales, security, enterprise, infosec, compliance, procurement]
---

# Enterprise Security Questionnaire Review — [Prospect Organization]

## 1. Compliance Mandates & Regulatory Drivers
- **Prospect Industry:** Financial Services & Wealth Management (SEC / FINRA regulated).
- **Mandatory Requirements:** Air-gapped capability, zero cloud telemetry, encryption at rest via local FileVault.
- **Key Security Concern:** Ensuring client meeting audio and proprietary intellectual property never train vendor AI models.

## 2. Technical Questionnaire Matrix & Verified Answers
| Security Domain | Prospect Inquiry | Verified Architecture Response | Compliance Status |
|---|---|---|---|
| **Data Residency** | Where are audio recordings and text notes hosted? | 100% on local Mac filesystem; zero cloud server storage | **Compliant** |
| **Model Training** | Are customer transcripts used to train AI models? | Never. Models run locally on-device via Ollama / Apple Silicon | **Compliant** |
| **Network Egress** | What telemetry packets are transmitted at runtime? | Zero telemetry by default; socket guards block outbound traffic | **Compliant** |
| **Key Management** | How are enterprise API tokens stored? | Stored encrypted in macOS Keychain with hardware enclave protection | **Compliant** |

## 3. Custom Requirements & Exception Requests
- **Exception Request:** Prospect infosec team requires a dedicated offline deployment installer package with pre-configured license keys.
  - *Engineering Evaluation:* Fully supported via standard macOS `.dmg` signed package without remote registration beacons.

## 4. Next Deal Milestones
- [ ] [[Sales Engineer Name]] Deliver cryptographic Wireshark egress verification report to prospect CISO.
- [ ] [[Account Executive]] Attach completed security questionnaire appendix to the master subscription agreement.
- [ ] Target Security Sign-Off Date: **[YYYY-MM-DD]**.

Filled Real-World Example

Here is a realistic example demonstrating how this template captures actual deliberations:

---
title: "Security Review: Vanguard Wealth Advisory"
date: 2026-10-09
prospect: "Vanguard Wealth Advisory"
lead_sales_engineer: "[[Samir Kassam]]"
prospect_ciso: "[[Evelyn Reed]]"
contract_potential: "$120,000 ARR"
security_status: "Cleared"
tags: [sales, security, enterprise, compliance]
---

# Enterprise Security Questionnaire Review — Vanguard Wealth

## 1. Security Alignment
Samir Kassam met with Evelyn Reed to review the 84-question vendor security assessment. The prospect's primary concern was ensuring client financial planning sessions cannot be intercepted by cloud AI proxies.

## 2. Verdict
Evelyn Reed confirmed that the app's local-only architecture meets all FINRA non-dissemination standards. The security review was formally approved with zero conditional exceptions.

When to Use and When to Avoid

When to Use

• Use during enterprise sales cycles when technical security teams evaluate software compliance.
• Use to record specific infosec objections, compliance frameworks, and verified technical answers.
• Use to establish a shared source of truth between sales engineers and corporate legal counsel.

When to Avoid

• Avoid using for informal preliminary sales qualification calls before security criteria are introduced.
• Avoid using for internal engineering vulnerability triage (use security post-mortem templates).

On-Device AI Integration

Summarize your recording in Oyma with this local instruction:

Analyze the security questionnaire review audio recording:
1. Extract all specific security requirements, compliance regulations, and data protection concerns voiced by the prospect.
2. Summarize the technical architecture answers provided regarding data residency, AI model privacy, and encryption.
3. Itemize outstanding security deliverables, requested exceptions, and the agreed target approval date.
Output in clean, structured Markdown.

Your data remains securely on your Mac with zero cloud exposure.