Don't lose the deal because the package doesn't exist yet.
Kompflow is the governance layer that gives you everything a client's security team asks for: WISP, risk assessment, vendor inventory, training records, and incident response plan. Already written, current, and signed.
Different companies send different forms, but the questions cluster into a familiar pattern:
They want your Written Information Security Plan (WISP). Not a template. Not a privacy policy. The actual written program that says what your firm protects and how.
Most enterprise security teams want a documented risk assessment from within the last 12 months, covering the scenarios that apply to a professional-services firm.
They're asking about MFA, least-privilege access, offboarding procedures, and audit logs. They expect proof, not assertions.
They want your vendor inventory with data-flow context, DPAs or subprocessor agreements, and which vendors touch client data.
They want your Incident Response Plan (IRP) with specific timelines, notification procedures, and a named point of contact.
They want training records: who, when, what modules, completion status.
For most mid-sized firms under the FTC Safeguards Rule, that's your Qualified Individual (QI). Name, title, and escalation path.
Three common ways this conversation breaks down:
The owner turns to the MSP and says “can you write this up for us?” The MSP says “we can give you a network architecture summary, but we don't write WISPs or do risk assessments.” The firm falls behind. Two weeks later, the prospect goes with a different vendor.
The owner sends a WISP template from 2022 that wasn't customized to the firm. The prospect's security team flags it as stale. The deal stalls in security review.
WISP on a shared drive somewhere. Training records in a separate system. Risk assessment from a consultant who left the firm two years ago. Putting the package together takes two weeks of someone's time. The prospect waits, then stops waiting.
A single place where every artifact a client or prospect might ask for is already generated, kept current, and ready to send.
Generated for your firm, kept current as your firm changes:
When the questionnaire lands, the package is ready. You send it the same day, not three weeks later.
You're bidding a large enterprise or public-company client and their procurement team is running a full vendor assessment.
A long-time client just got a new CISO, and suddenly all vendors are getting re-reviewed.
The RFP includes a security attachment that needs 40+ questions answered.
A client (or a regulator) asks for documentation under time pressure.
The Insurance Gap Assistant(Professional and Premium) was built for cyber insurance questionnaires, but the same logic works when a client's security team sends a questionnaire. Ask it things like:
The assistant reads your actual firm data and helps you draft responses grounded in what you have, not generic advice. You always review and approve before any of it goes to the client.
WISP, risk assessment, training records, incident response basics, vendor inventory. The full security package, without the AI assistant.
Everything in Starter + Insurance Gap Assistant (15 questions/day), Microsoft 365 auto-sync, evidence-backed control testing, QI workflow.
Everything in Professional + unlimited Insurance Gap Assistant, dedicated onboarding.
Some MSPs can answer the network-and-infrastructure questions. Very few can produce a WISP, a risk assessment, documented risk decisions, training records, or a vendor inventory. Those are governance artifacts that sit with the firm, not the MSP. That's where Kompflow fits.
The Insurance Gap Assistant (Professional and Premium) can tell you whether you have it and where it lives. If you don't have it yet, it tells you what's missing and how to close the gap. Most client questionnaires map to artifacts Kompflow already produces.
Not a branded library today. The Insurance Gap Assistant is carrier-agnostic and questionnaire-agnostic, and it answers based on your firm's data rather than a pre-canned response set. Pre-built questionnaire templates are under consideration on the roadmap.
Yes. You choose which artifacts to include. Most firms send the same core package: WISP, risk assessment, IRP, training summary, QI identification, and add vendor-specific pieces (data-flow maps, specific control evidence) as requested.
30-day money-back guarantee on every firm plan.
We use cookies to measure site performance and improve your experience. No data is sold to third parties. Privacy Policy