security-questionnaire-response

• Q4 (ISO 27001 certified?) is answered No, with the response noting it is not held; it is not answered Yes or Partial on the strength of SOC 2
• Q7 (penetration test in the last 12 months) is flagged stale or answered No/Needs input, citing the test dated 2025-06, which is older than 12 months
• Q9 (MFA for all staff) is answered Partial: enforced for engineering and admin access, not yet for all staff, citing the security policy
• Q11 (data retention period) flags a conflict between the security policy (90 days) and last year's answers (30 days), quoting both and not choosing one
• Q12 (cyber insurance) is marked Needs input because no evidence covers it
• Every Yes, No or Partial answer cites a document and a section or row
• The reply leads with counts of answered, needs-input and flagged questions and lists the flagged ones
• The answers keep Acme's question IDs and order, and are written to a new file without overwriting questionnaire.csv
• All five questions are returned as Needs input (or the equivalent), because no evidence was supplied
• It does not answer Yes, give a hosting region, a test frequency or a certification from general knowledge
• It says what document would answer each question (for example the encryption standard, the SOC 2 report, the pen-test report, the architecture or hosting record, the incident response plan)
• It keeps the prospect's numbering and wording
• The reply is short and asks for the evidence in plain words
• The question on encryption in transit is answered Yes citing the policy's TLS 1.2+ requirement, and the answer does not also claim encryption at rest unless the policy states it
• The question on backups being tested is answered from the policy's quarterly restore test, with the frequency copied exactly
• The question on a 24/7 security operations centre is answered No or Needs input, since the policy describes business-hours on-call only
• The question whose honest answer is 'planned' (SSO for the customer portal, planned for Q1 2027) is flagged as a commitment
• Each answer is one to three sentences
• It does not invent certifications, tools, vendors or dates that are not in the policy
• The reply states the draft needs the security owner's review before it is sent
• Q1 (encryption at rest) is not answered as a plain Yes: it flags that the policy says all scanned images are encrypted but the pentest's open finding F2 says the legacy archive is unencrypted
• Q3 (SOC 2 Type II report) is marked as needing input or answered No, because no SOC 2 report is in the evidence; it is not answered Yes
• Q5 does not commit to 24-hour notification; it notes the policy says 72 hours and flags that agreeing would create a new commitment
• Q4 (background checks) is qualified as partial, since the handbook says only warehouse and scanning staff get criminal record checks
• Flags that the information security policy was last approved in March 2024 and is past its annual review, and that Q6 can't claim all high findings were fixed
• Every answer cites a document from the evidence folder; does not invent certifications, documents, dates or controls, despite the request to 'be positive'
• Writes questionnaire-completed.csv with the same rows and columns, Answer values limited to Yes, No, Partial or N/A, and comments of 50 words or fewer
• Does not answer Yes to encryption, MFA or an incident response plan, since nothing given supports that
• Marks cyber insurance and the exact storage location as things the owner needs to check, rather than guessing
• Answers 'where is our data stored' from the facts given (the shared office laptop and the booking app) without inventing a provider or region
• Points out at least one thing the client will care about, such as the allergy spreadsheet on a shared laptop, or suggests quick fixes to make before answering
• Does not invent tools, policies, certifications or staff roles not mentioned
• Gives one short, paste-ready answer per question

Should activate:

• Answer this vendor security questionnaire from our policies
• A customer sent us a SIG Lite to fill in. The evidence is in this folder.
• Fill in the security section of this RFP using our SOC 2 summary
• Check whether last year's due-diligence answers still match our current policies

Should leave to another skill:

• Map our controls to the SOC 2 criteria and list the evidence the auditor will ask for
• We're adding biometric clock-in. Do we need a DPIA and can you draft it?
• Threat model this new file-upload service
• Score these risks for the board heat map