If I have any “No” responses in the security review wizard, or no formal and detailed documentation, do I fail the review?

No. Although the questions ask for formal and detailed documentation, we understand that, depending on the size and maturity of your company, this might not be possible. We designed the wizard to cover a broad spectrum of companies, from small to large. Smaller companies can provide us with a checklist instead of formal documentation of their security policies. If you have to answer “No” to some questions, use the comments box to explain. We understand that the scoring isn’t black and white, and we factor in elements like company size and maturity to guide our decision-making.