The knowledge base

Every security questionnaire asks roughly what the last one asked. The Knowledge base is where the answer lives once, so the second, fifth and fortieth questionnaire are edits rather than compositions.

What is in it

An article is a question and an answer — “Do you encrypt data at rest?”, and the paragraph you would write back. Not documentation: reusable answer text, in the voice you want a buyer to read.

Articles carry a status (draft until published), version history with a diff against the current text, and tags that group them by topic so authors and filters can target them.

They can also be linked to a control, a policy or a framework, which is what turns the knowledge base from a snippet library into something maintainable: when a control changes, the articles claiming it are one click away.

How it pays off

• Inbound questionnaires — the ones customers send you — draft their answers from published articles, for a person to review before anything goes back. See Assessing a vendor for the outbound direction and the inbound tab.
• The Trust Center assistant answers visitors from your published content, and reports the questions it could not answer — which is the best possible prompt for the next article. See Publishing a Trust Center.
• Semantic search across the platform finds an answer by meaning rather than by the words you happened to use.

Publish deliberately — this text goes to customers

A draft is private; a published article is answer material that can reach a buyer with a person’s light review in between. Write the answer you would be happy to see quoted back to you in a procurement thread, and keep the ones that describe an aspiration in draft until they describe a fact.

Keeping it honest

The failure mode is not an empty knowledge base — it is a stale one, where an answer describes a control you changed eighteen months ago and nobody noticed, because the article was right when it was written.

Two habits:

• Answer from the article, then fix the article. When you edit an answer while responding to a questionnaire, push the improvement back. Otherwise the good version lives in a submitted response nobody can search.
• Review by tag on a cadence. Take one topic a month rather than attempting the whole library, and check each answer against the control that backs it. Version history means you can see what changed and when.