Use security-questionnaire-response

Answer a customer's security questionnaire from your own evidence

Answer a customer's security questionnaire from your own evidence: each question gets a direct answer (Yes, No, Partial or Not applicable), a short narrative, and the document and section it rests on. Questions the evidence doesn't cover are marked as needing input instead of being answered, and conflicts between sources, stale evidence and answers that would commit you to future work are flagged for the security owner.

Reach for it when the user has a vendor security questionnaire, a SIG or CAIQ, a due-diligence spreadsheet or the security section of an RFP to fill in, or says "answer this security questionnaire", "fill in this vendor assessment".

Install it

npx skilldrop-cli install security-questionnaire-response                 # Claude Code, your user folder
npx skilldrop-cli install security-questionnaire-response --project       # Claude Code, this repo
npx skilldrop-cli install security-questionnaire-response --ide cursor    # or kiro, codex, antigravity, copilot

It is part of the Governance, risk and compliance pack: --pack grc installs it with its neighbours.

Ask for it

Say it the way you would to a colleague. Requests like these route to it:

• "Answer this vendor security questionnaire from our policies"
• "A customer sent us a SIG Lite to fill in. The evidence is in this folder."
• "Fill in the security section of this RFP using our SOC 2 summary"
• "Check whether last year's due-diligence answers still match our current policies"

Requests like these belong to a different skill, so it shouldn't answer them:

• "Map our controls to the SOC 2 criteria and list the evidence the auditor will ask for"
• "We're adding biometric clock-in. Do we need a DPIA and can you draft it?"
• "Threat model this new file-upload service"

If another skill answers instead, ask for this one by name: "use security-questionnaire-response".

Check what you get

A good result:

• Every Yes, No and Partial cites a document and a place in it.
• Nothing is claimed that the evidence does not show: no certification, test, number or control is invented or upgraded.
• Gaps are visible. Needs-input and flagged questions are counted and listed first.
• Conflicts are shown, not resolved.
• The customer's IDs, order and wording of questions are preserved.

Use something else when

• Mapping your controls to SOC 2 criteria and the evidence an auditor wants. Use soc2-evidence-map.
• Assessing a processing activity's risk to individuals under GDPR. Use dpia.
• Finding the threats in a system design. Use threat-model.
• Listing and scoring business risks. Use risk-register.

Next

• SKILL.md, the instructions the agent reads
• Its page on the site
• Related: dpia, risk-register, soc2-evidence-map, threat-model

Edit this page on GitHub · View source