---
name: "security-questionnaire-answers"
description: "Draft security questionnaire answers from cited evidence, with gaps and owner questions listed."
triggers: ["security questionnaire", "vendor assessment", "SIG", "CAIQ", "customer security review"]
version: "1"
---
# Security questionnaire answers
Use this for a customer questionnaire, a SIG, a CAIQ, or a portal form.
## Match questions to evidence
Count the questions and check the import is complete. For each question find
the policy, report, config export, or approved past answer that covers it.
Reuse a past answer only when the question truly asks the same thing and the
evidence behind it is still current.
## Draft the answers
For each answer give:
- the answer: yes, no, partial, or not applicable;
- one or two plain sentences of detail;
- the source document, version, and section;
- the date of the evidence.
Answer "partial" when a control covers some systems and not others, and say
which. Do not soften a "no" into a vague yes.
## Gaps and owners
List every question the evidence does not answer, with the owner who can,
and the owner-approved date to ask by. If no date was supplied, mark it
unknown and ask the owner to set it. Keep legal questions (liability, legal
basis, breach terms) on a separate list for counsel. Give counts: answered,
partial, gap.
Never answer yes to a certification, control, or audit result without
evidence; mark it as a gap. This is not legal advice. Do not submit the
questionnaire or send it; the owner reviews and submits.