Methodology question bank builder

## Question Bank — SPICED | Northwind Pay _SPICED fits because there's a clean compelling event (Q3 enterprise renewal gating on SOC 2 Type II + questionnaire) — diagnose Situation through Decision before positioning iCompaas against the Vanta renewal._ ### Situation - Q1: Walk me through how evidence collection actually works today between your team, Vanta, and the spreadsheets you mentioned — who touches what, and how often? - variant (blunt): What does Vanta automate today vs. what your team still does by hand? | variant (exec): At a high level, where does the compliance program stand against your SOC 2 and PCI commitments? | variant (metrics): How many controls are still manually evidenced each cycle? - Q2: You're the first dedicated security hire — what did the program look like before you, and what's already on Vanta vs. greenfield? - variant (blunt): Who owned this before you, and what did you inherit? | variant (exec): How mature would you call the program on a 1-5 scale today? | variant (metrics): How many of the SOC 2 / PCI controls have an owner assigned? ### Pain (problem + root cause) - Q1: When you say Vanta 'nags but doesn't do the work,' what specifically breaks — is it the integrations not pulling evidence, or the team not trusting what it collects? - variant (blunt): What's the single most painful part of a Vanta evidence cycle? | variant (exec): Where is the current tooling falling short of what the board expects? | variant (metrics): How many hours/week does your team spend reconciling Vanta against the actual spreadsheets? - Q2: Is the root cause the tool, the process, or the fact that there's one of you covering SOC 2, PCI, and enterprise questionnaires at once? - variant (blunt): If you had to name the one thing that has to change, what is it? | variant (exec): Is this a tooling gap or a capacity gap? | variant (metrics): How many open security questionnaires are sitting in your queue right now? ### Impact (quantified cost) - Q1: If SOC 2 Type II and the questionnaire aren't done by end of Q3, what happens to the enterprise renewal — and what's that logo worth? - variant (blunt): What's the dollar value of the deal that's gated on this? | variant (exec): What's the revenue exposure if the Q3 date slips? | variant (metrics): 7-figure renewal — is that ARR, TCV, and how much is at risk? - Q2: Beyond that one renewal, how many deals are stalling in security review, and what's the manual-evidence time costing you in headcount you'd rather spend elsewhere? - variant (blunt): What is the spreadsheet chase actually costing you? | variant (exec): What's the opportunity cost of your team doing this by hand? | variant (metrics): How many sales cycles per quarter touch a security questionnaire? ### Critical Event (date-bound) - Q1: The enterprise renewal is end of Q3 and PCI DSS 4.0 is year-end — which is the immovable date, and what has to be true 30 days before it? - variant (blunt): What's the hard deadline we're working back from? | variant (exec): Which commitment can't slip — the renewal or PCI? | variant (metrics): How many weeks of audit fieldwork do you need before the Q3 date? - Q2: If we mapped backward from end of Q3, when would a new evidence-automation platform need to be live to make the Type II observation window? - variant (blunt): How late can you switch off Vanta and still hit Q3? | variant (exec): What's the go-live date that de-risks the renewal? | variant (metrics): What's your Type II observation period — 3, 6, or 12 months? ### Decision (criteria, process, stakeholders) - Q1: You mentioned the CFO controls budget and is skeptical of 'another tool' — is this a replace-Vanta decision or an add-a-tool decision in their eyes, and who else weighs in? - variant (blunt): Who has to say yes besides you? | variant (exec): How does a tooling decision of this size get approved here? | variant (metrics): What's the budget envelope already set aside for the Vanta renewal? - Q2: What would the CFO need to see to treat this as cost-neutral against the Vanta renewal rather than net-new spend? - variant (blunt): What makes this a no for the CFO? | variant (exec): What's the business case that gets finance on side? | variant (metrics): If we displaced Vanta, what's the renewal number we'd be offsetting? - Q3: What are your must-have evaluation criteria — integration coverage, questionnaire automation, PCI 4.0 support — and how will you compare us to staying on Vanta? - variant (blunt): What would make you pick us over renewing Vanta? | variant (exec): What does 'good' look like at the end of the eval? | variant (metrics): How many of your stack's integrations need native evidence pulls? ### Example dialogue Rep: Walk me through a Vanta evidence cycle today — what's automated vs. by hand? Buyer (Dana): Honestly, it pulls some cloud config, but my team still chases owners in spreadsheets every quarter. It nags; it doesn't do the work. Rep: When the enterprise questionnaire landed, how long did it sit before someone could answer it? Buyer: Three weeks. I'm the only one who can, and I'm buried in SOC 2 prep. Rep: That renewal — what's gated on getting Type II and the questionnaire done by Q3? Buyer: It's our biggest logo, seven figures. If we miss it, that's a very bad board meeting. Rep: So the immovable date is end of Q3, and PCI 4.0 follows at year-end — and the CFO sees this as 'another tool.' Buyer: Right. He'd need to see it isn't just incremental spend on top of Vanta. Rep: Then the cleanest path is replacing Vanta so the renewal budget offsets us, with questionnaire automation and PCI 4.0 coverage proven before you commit — that's exactly where iCompaas pulls evidence automatically and auto-drafts the security review. Want to map a Q3-backward timeline? ### Coach's note - Listen for the dollar figure on the gated renewal and the exact Q3 date — those convert Pain into a quantified, date-bound case the CFO can't wave off. - Trap question: 'How late can you switch off Vanta and still hit Q3?' — it forces the Critical Event to do the urgency work for you. - Stop discovering and start positioning only once Decision criteria + the CFO's 'cost-neutral vs. Vanta' frame are explicit; that's the moment differentiated value (auto-evidence, questionnaire automation, PCI 4.0) lands instead of bouncing off as 'another tool.'