8

PROVING YOUR INFRASTRUCTURE

The Definitive Guide

8 chapters Last updated 21 September 2026 Free to read, no account

At some point a larger customer, an insurer or a buyer asks you to demonstrate that your infrastructure is looked after. The questions are more predictable than they look, and almost all of them are about duration rather than current state.

That distinction is the difficult part. Current state is easy to assert and proves very little. How long something has been the case cannot be asserted at all if nobody was recording.

This guide covers what is actually asked, why it is asked that way, and how to answer without spending a week assembling documents.

In this guide you will learn:

  • What a vendor security questionnaire actually contains
  • Why the questions are about duration rather than state
  • What insurers and buyers ask that differs
  • How to answer as a small business without SOC 2
  • What evidence is stronger than an assurance
  • What to start recording now that cannot be recovered later

Contents

1

What gets asked

The recurring questions, stripped of industry-specific noise.

2

Why duration rather than state

What the person assessing you is actually managing.

3

Procurement, insurance and diligence

Three audiences, overlapping questions, different stakes.

4

Answering without a compliance programme

What a small business can credibly demonstrate.

5

Evidence versus assurance

Why being checkable beats being believed.

6

What to record

The minimum that answers most of it.

7

What cannot be produced afterwards

The window that closed before the question arrived.

8

Making it a link rather than a task

Answering once instead of every time.

Chapter 1

What gets asked

The recurring questions, stripped of industry-specific noise.

What gets asked

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Chapter 2

Why duration rather than state

What the person assessing you is actually managing.

Why duration rather than state

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Chapter 3

Procurement, insurance and diligence

Three audiences, overlapping questions, different stakes.

Procurement, insurance and diligence

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Chapter 4

Answering without a compliance programme

What a small business can credibly demonstrate.

Answering without a compliance programme

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Chapter 5

Evidence versus assurance

Why being checkable beats being believed.

Evidence versus assurance

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Chapter 6

What to record

The minimum that answers most of it.

What to record

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Chapter 7

What cannot be produced afterwards

The window that closed before the question arrived.

What cannot be produced afterwards

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Chapter 8

Making it a link rather than a task

Answering once instead of every time.

Making it a link rather than a task

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Check yours

See where your own domain stands.

Everything in this guide, checked on your domain in about ten seconds. Free, no account, every finding shown in full.