Security work, and the documentation practice I run

I lead security engineering in my full-time role. In that role I write security policies, run vendor security assessments, and answer enterprise security reviews. Through Blank Slate Creative, I offer that kind of paperwork to other small companies. This page covers that work, and where it stops.

Both sides of the paperwork

A security questionnaire has two sides, and at work I handle both. I assess what vendors send, and I answer what customers ask. The documents I write for Blank Slate Creative are written with the reader on the other end in mind.

Blank Slate Creative

Blank Slate Creative is a one-founder security documentation practice, and I’m the founder. It writes security policies, SOC 2 readiness documentation, and vendor security questionnaire answers for startups and lean engineering teams, tailored to how the team actually runs.

Everything is written from public frameworks and from what the customer tells me. I never draw on another company’s confidential material. An AI model helps draft the documents I write. I read every custom deliverable before it goes out.

Where the practice stops

• No audits or attestations. Blank Slate Creative does readiness and documentation work only. A SOC 2 report comes from an independent CPA firm.
• No promised outcomes. A customer or an auditor decides what is enough. I can’t promise how anyone will judge a document.
• No borrowed credibility. I don’t claim certifications I don’t hold.

Free guides to start with

Blank Slate Creative publishes free guides for people who got handed this paperwork. These five are a good place to begin.

• The first five security policies a startup needs before SOC 2Why policies come before controls and evidence, and which five to write first.
• Do you need SOC 2 yet? What to send before you have a reportFor when a customer asks for a SOC 2 report and you don’t have one.
• Your first security questionnaire: a five-day planHow to answer a first vendor security questionnaire in five working days.
• Answering a security questionnaire when you don’t have the controlHow to describe a compensating control or a roadmap item without guessing.
• An incident response plan a five-person team will followWho leads, how to rank severity, who to tell, and a 30-minute test.

If you have a request in front of you

If a customer or an investor has asked you for security paperwork, you can tell me what you need through the inquiry form on blankslate.biz.

—E