Do not lose the deal because the package does not exist yet.
Kompflow is the governance layer that gives you everything a client's security team asks for: WISP, risk assessment, vendor inventory, training records, and incident response plan. Already written, current, and signed.
Different companies send different forms, but the questions cluster into a familiar pattern:
They want your Written Information Security Plan (WISP). Not a template. Not a privacy policy. The actual written program that says what your firm protects and how.
Most enterprise security teams want a documented risk assessment from within the last 12 months, covering the scenarios that apply to a professional-services firm.
They are asking about MFA, least-privilege access, offboarding procedures, and audit logs. They expect proof, not assertions.
They want your vendor inventory with data-flow context, DPAs or subprocessor agreements, and which vendors touch client data.
They want your Incident Response Plan (IRP) with specific timelines, notification procedures, and a named point of contact.
They want training records: who, when, what modules, completion status.
For most mid-sized firms under the FTC Safeguards Rule, that is your Qualified Individual (QI). Name, title, and escalation path.
Three common ways this conversation breaks down:
The owner turns to the MSP and says “can you write this up for us?” The MSP says “we can give you a network architecture summary, but we do not write WISPs or do risk assessments.” The firm falls behind. Two weeks later, the prospect goes with a different vendor.
The owner sends a WISP template from 2022 that was not customized to the firm. The prospect’s security team flags it as stale. The deal stalls in security review.
WISP on a shared drive somewhere. Training records in a separate system. Risk assessment from a consultant who left the firm two years ago. Putting the package together takes two weeks of someone’s time. The prospect waits, then stops waiting.
A single place where every artifact a client or prospect might ask for is already generated, kept current, and ready to send.
Generated for your firm, kept current as your firm changes:
When the questionnaire lands, the package is ready. You send it the same day, not three weeks later.
You are bidding a large enterprise or public-company client and their procurement team is running a full vendor assessment.
A long-time client just got a new CISO, and suddenly all vendors are getting re-reviewed.
The RFP includes a security attachment that needs 40+ questions answered.
A client (or a regulator) asks for documentation under time pressure.
The Insurance Gap Assistant(Starter and Professional) was built for cyber insurance questionnaires, but the same logic works when a client's security team sends a questionnaire. Ask it things like:
The assistant reads your actual firm data and helps you draft responses grounded in what you have, not generic advice. You always review and approve before any of it goes to the client.
WISP, full risk assessment with reporting, data inventory, training records, incident response plan, vendor inventory, and the Insurance Gap Assistant for drafting questionnaire answers.
Everything in Starter, plus Microsoft 365 auto-sync, evidence-backed control testing, the controls register, task management, and ongoing compliance event tracking.
Some MSPs can answer the network-and-infrastructure questions. Very few can produce a WISP, a risk assessment, documented risk decisions, training records, or a vendor inventory. Those are governance artifacts that sit with the firm, not the MSP. That is where Kompflow fits.
The Insurance Gap Assistant (Starter and Professional) can tell you whether you have it and where it lives. If you do not have it yet, it tells you what is missing and how to close the gap. Most client questionnaires map to artifacts Kompflow already produces.
Not a branded library today. The Insurance Gap Assistant is carrier-agnostic and questionnaire-agnostic, and it answers based on your firm's data rather than a pre-canned response set. Pre-built questionnaire templates are under consideration on the roadmap.
Yes. You choose which artifacts to include. Most firms send the same core package: WISP, risk assessment, IRP, training summary, QI identification, and add vendor-specific pieces (data-flow maps, specific control evidence) as requested.
30-day money-back guarantee on every firm plan.
The artifacts behind a polished vendor-security response.
We use cookies to measure site performance. No data is sold to third parties. You can opt out at any time. Privacy Policy