Cichocki Advisory is principal-led, implementation-neutral, and procurement-aware from the first conversation.
Security & Procurement
Security Questionnaire
Cichocki Advisory completes vendor security questionnaires as part of procurement onboarding. Mutual NDA executes before any response leaves; responses are written by Jan Cichocki personally and returned within five business days of NDA + scope confirmation.
Mutual NDA first5 business day SLAPrincipal-completedProcurement-aware
Accepted questionnaire formats
I respond to standard procurement formats or your vendor's own template. Click any format for details.
Send the blank questionnaire as an attachment in your initial request. I’ll confirm scope and timeline before starting.
What my response includes
Where applicable to the chosen questionnaire format. Click any item for details.
How the workflow runs
1
Request
Submit via the security materials request form or your procurement portal. Attach the blank questionnaire and note your deadline.
Acknowledged within 1 business day
2
NDA & scope
Mutual NDA executes before any response content is shared. Scope is confirmed: advisory engagement type, expected sensitive materials, target dates.
NDA: your template or mine
3
Response drafted
Questionnaire is completed by Jan Cichocki personally. Any items requiring external attestation or third-party review are marked as such, not asserted.
Within 5 business days of NDA + scope confirmation
4
Delivery & review
Response delivered with companion artifacts on request (COI, DPA template, subprocessor list).
Acknowledgement of receipt requested
Procurement windows. I acknowledge every request within one business day. Delivery clocks start when the mutual NDA is executed: the procurement packet (COI, W-9, NDA, DPA, data-handling overview) within two business days, not including a newly completed security questionnaire; a completed questionnaire within five business days of the executed NDA and scope confirmation.
What I don’t claim
Cichocki Advisory does not hold a third-party SOC 2 Type II attestation, ISO/IEC 27001 certification, or formal pen-test report. My control set is mapped to SOC 2 Trust Service Criteria; documentation describing that mapping is available under NDA.
I respond to every questionnaire item with one of: yes (with control reference), no (with explanation), partial (with scope), or not applicable (with reason). I do not fabricate "yes" answers to questions where the control isn’t implemented at my scale.
Ready to submit a questionnaire?
Send the blank questionnaire, your timeline, and a primary contact. I’ll confirm scope and NDA within one business day.
Hi! I can answer questions about Cichocki Advisory's published frameworks, services, and procurement materials. Please don't enter confidential, regulated, or sensitive information.
Do not enter confidential, regulated, or sensitive information.
Privacy Policy
