(no title)
emremm | 5 years ago
We build a 'profile' of the company - what it does, they systems used, the type of data it handles (and doesn't) to answer these questionnaires.
Part of the purpose of having a human-in-the-loop - especially for the first 1-2 questionnaires, is to support this type of review and ensure that answers are a sufficiently high quality.
As a general rule of thumb when answering security questionnaires (which our system supports), any "negative" answer should have additional clarification. FWIW, I'd say that a more appropriate answer to that question would be N/A instead of No to avoid confusion, assuming that the company doesn't handle any PHI / CHD.
sverhagen|5 years ago
This is pretty much the experience I expect. And I just don't see how this can be automated well (yes, I read the human-in-the-loop remark, but also the 15 seconds one), if there's such unstructured data, both on the input as well as the output side of this process. It seems to me you're just going to be renting out a glorified copywriter or editor.
joetheone|5 years ago
It's totally fair to be skeptical that we can pull that off. I will say though that we are fanatical about NOT making this a business where we hire lots of humans to be reviewers. We'd rather fail than hire an army of low wage workers to do the soul sucking job of reviewing other people's questionnaires all day every day.