Compliance readiness
The security questionnaire stops eating your week.SOC 2 readiness
Answers from your real cloud settings. Approved answers come back on the next questionnaire, each one carrying the evidence it was drafted from.
This is the questionnaire and evidence half of compliance work. It is not continuous control monitoring across your HR, device and vendor systems, and readiness evidence is not certification.
Which frameworks does it track?
Readiness indicators built from checks MarshalCloud actually runs. A control with no failing check reads “no issues detected by our checks”, never “compliant”.
SOC 2
Readiness indicator for every criterion: what we check, what you attest, and what we cannot see.
ISO/IEC 27001:2022
Annex A, with a Statement of Applicability export.
CIS AWS, HIPAA, GDPR
Readiness indicators, plus controls you add.
NIST CSF 2.0, SP 800-171
Questionnaires from NIST's own published catalogs.
How do I answer a security questionnaire fast?
Answer each control once and reuse it. The rest are drafted only where your evidence supports them, with the source cited.
How a questionnaire is answered
Matched
To an answer you already approved.
Drafted or left
Drafted with a citation, or left for a person.
You sign
A person approves, under their own name.
Waiting for youExported
An unsigned answer is left out.
The answers come from the checks behind them.
Readiness or certification: what is the difference?
Readiness: which controls your settings support today. Certification: an auditor's conclusion. MarshalCloud gives you the first and evidence for the second.
The evidence pack
- Real findings, timestamps and control mappings.
- Your own change logs.
- Security leads, admins and owners only.
Which plan is compliance readiness on?
Startup and above, with a 15-day trial. It shares one plan gate with the security checks it is built from.
Our own SOC 2 status is on Trust and security.
Every plan, side by side- Readiness indicators and the evidence pack
- Startup and above
- Security questionnaires and the answer library
- Startup and above
Questions about compliance readiness
01What is the difference between readiness and certification?
Readiness says which controls your current settings support and which need attention, from checks run against your account. Certification is an auditor's conclusion after an audit. MarshalCloud gives you the first and evidence to support the second. It never claims the second.
02How are questionnaire answers drafted?
A question is first matched to an answer you already approved. Only if none fits is an answer drafted, and only when your own policies or scanned settings support one, with the source cited. A question nothing supports is left for a person. MarshalCloud never marks an answer approved; a person does, under their own name.
03What is in the evidence pack, and who can open it?
Real findings, timestamps and control mappings from the automated checks and your own change logs. It does not assert that you comply with any framework. It holds your account activity trail, so only your security lead, admins and owners can open it.
04Is MarshalCloud itself SOC 2 certified?
No. Our own formal SOC 2 work (retention, access reviews, an incident runbook, a penetration test) is in progress, not done. The Trust page lists what is built today.
Bring the next questionnaire.
Starts on Startup, with a 15-day trial. Connect one AWS account read-only and see which controls your settings support.