The testing section of an enterprise security questionnaire is usually five questions: is there a documented release procedure, how are findings classified, how fast does a critical finding reach a person, how are releases signed off, and can you show evidence. A release record answers all five if it is written for that reader.
The record
One release, one record, four fields plus findings:
- Build hash and date
- Checklist version (for example v1.0, verified 2026-09-21)
- Tester name
- Verdict (a one-word release result (pass, pass with findings, fail) with the findings and the checklist version behind it): pass, pass with findings, fail
- Findings by severity, each with checklist id and pattern
That is checklist item DR-05. It is low severity if failed, because a missing record does not break the product. It is the item questionnaires care about most.
Mapping the five questions
Documented procedure. The checklist URL and version. It is public; the reviewer can read every item and its pass criterion.
Classification. The severity definitions on the checklist page: critical is data exposure, money or account takeover; high a broken core flow; medium a degraded flow; low cosmetic or reporting.
Escalation. Critical findings reach the named contact within 4 business hours on every plan. Write the number, not the adjective.
Sign-off. The tester's name on the record, and the third of the five written guarantees: every release tested against the published checklist version in force.
Evidence. The last three records and the last monthly report. The sample report shows the format; a real one carries your build hashes.
What to say you do not do
Reviewers score honesty. The record does not claim a penetration test, an attestation, or coverage of anything outside the plan's scope. The what we cannot do page is written to be quoted in a questionnaire answer.
The week-one sequence
If the questionnaire arrived before the records exist, the situation page gives an ordered five-day sequence: adopt the checklist and start recording, run the items reviewers ask about by name, rehearse rollback, and write the answers with the records attached.