Questionnaire and DDQ response
Purpose
Questionnaire answers are contractual representations to a counterparty. They get
recycled from the last response, drift from what is actually operated, and one
plausible sentence about an encryption standard or a retention period becomes a
misrepresentation that surfaces during an incident or an audit. This skill makes
the evidence source, not the sentence, the unit of work: no answer exists until a
named document supports it, and questions without support are returned marked as
such rather than filled in.
Data classification
Confidential. A completed questionnaire is a map of the organisation's
controls and its weaknesses. Treat drafts as restricted to the response team and
release only under the counterparty's NDA.
STOP CONDITIONS:
| Trigger |
Action |
| The question asks for live secrets — keys, credentials, tokens, certificate private material, internal hostnames, IP ranges, or network diagrams at address level |
Stop. These are never questionnaire answers. Offer the control description instead and route the request to the security function. |
| The question asks for unredacted findings from a penetration test, audit or incident report |
Stop. Route to the security and legal owners; these are released under specific terms or summarised, not pasted. |
| Customer or employee personal data is pasted as an illustration |
Stop. Ask for it to be removed; a questionnaire needs the control, not the record. |
| The questionnaire relates to an active dispute, investigation, enforcement action or litigation |
Stop. Route to counsel before anything is drafted. Privilege and disclosure decisions come first. |
| The counterparty asks for a signed attestation, certification, warranty or officer sign-off |
Stop drafting at the point of signature. Prepare the content; the signature is an authorised human act and is named, never assumed. |
| The user asks to answer "yes" because the control is planned, in progress, or on the roadmap |
Stop. Planned is not implemented. Use the roadmap answer form in step 5 or mark it a gap. |
NON-FABRICATION RULE. Never state that a control exists, a standard is met, a
certification is held, an audit was passed, a policy is in force, or a figure
(RTO, RPO, retention period, uptime, headcount, training completion) holds, unless
a supplied evidence source says so. Never carry an answer forward from a previous
response without re-verifying its source is current. Never infer a control from
the existence of a related one. Never soften an UNANSWERABLE into a hedge — "we
follow industry best practice" in place of a fact is an answer that will be read
as a commitment. Where evidence is missing, the output is
UNANSWERABLE — no evidence source; assign to <function>.
An invented questionnaire answer is a misrepresentation to a counterparty. It is
relied on, it may be incorporated into a contract, and it survives in their file
for years.
Prerequisites
- Inputs (mandatory): the questionnaire itself, complete, with the question
numbering and any answer-format constraints (yes/no, free text, character
limits, mandatory evidence attachments).
- Inputs (mandatory): the evidence library, or the documents standing in for
it — policies, standards, certifications and their scope statements and expiry
dates, audit reports, architecture descriptions, register extracts, prior
approved answers with their approval dates.
- Inputs (mandatory): the scope of the engagement being assessed — which
product, which entity, which jurisdiction, which data categories. Answers differ
by scope, and a right answer about the wrong entity is a wrong answer.
- Inputs (mandatory): the named owners per domain — security, privacy,
compliance, legal, HR, operations — and who is authorised to attest.
- Inputs: the return deadline and the counterparty's escalation contact.
- Access: the evidence repository, at read level. If the library does not
exist yet, run step 1 and stop; there is nothing to answer from.
If a mandatory input is missing, name it and stop.
Procedure
1. Build or refresh the answer library before answering anything
The library is the asset; the questionnaire is a query against it. Each entry:
| Field |
Why it exists |
| Control or topic |
The thing being asserted |
| Approved answer text |
The exact wording cleared for external release |
| Evidence source |
Named document, version, section — not "our policy" |
| Evidence date and expiry |
Certifications expire; an expired source is not a source |
| Scope qualifier |
Which entity, product, environment and region it covers |
| Owner |
The named function accountable for the assertion |
| Approval date and approver |
When a human last confirmed it is still true |
| Release classification |
Public, under NDA, or never released |
An entry whose evidence is older than its review cycle is treated as
NEEDS-SME, not as SOURCED.
2. Parse and normalise the questionnaire
Number every question, including sub-parts, so nothing is answered by
association. Split compound questions — "do you encrypt data at rest and in
transit and manage keys in an HSM" is three assertions and may have three
different answers. Record required format per question; an essay in a yes/no
field is often scored as a non-answer.
3. Classify each question before drafting
| Class |
Meaning |
Handling |
| Factual-sourced |
An evidence entry answers it directly and in scope |
Draft from the approved text; cite the source |
| Factual-adjacent |
The library covers a neighbouring scope or an older version |
NEEDS-SME. Do not stretch the scope qualifier |
| Attestation |
Asserts legal, regulatory or security compliance, or requires signature |
Route to the named authorised human. Draft content, never sign |
| Judgement |
Asks for an opinion, a risk assessment, or a commitment about the future |
Route to the domain owner; these are decisions, not lookups |
| Gap |
The control genuinely does not exist or is partial |
Step 5 |
| Out of scope |
Concerns a product, entity or region not in the engagement |
Answer "not applicable" with the reason; an unexplained N/A reads as evasion |
| Unanswerable |
No evidence and no owner identified |
Mark UNANSWERABLE and assign |
4. Draft with the source attached to every answer
Answer format: the direct answer · the control described in operating terms ·
the evidence source and date · the scope qualifier. Answer the question that was
asked, in the format requested, before adding context. Never exceed what the
evidence supports; if the policy says quarterly, the answer says quarterly, not
"regularly".
5. Handle gaps honestly, because gaps are survivable and discovered lies are not
A partial or absent control is stated as: what exists today · what does not · the
compensating control if there is one · whether remediation is committed, with a
date and an owner, and only if it is genuinely approved. Counterparties routinely
accept a disclosed gap with a plan. They do not accept discovering that an answer
was untrue, and neither does a regulator.
6. Route the review before return
| Answer class |
Reviewer |
| Factual-sourced, unchanged from approved text |
Response owner |
| Factual-sourced, reworded for this questionnaire |
Domain owner |
| Attestation, legal or regulatory |
Counsel or the accountable officer, named |
| Gap or remediation commitment |
Domain owner plus the person who owns the plan |
| Anything referencing contractual terms, liability, indemnity or jurisdiction |
Counsel |
Return with a completeness statement: answered, NEEDS-SME, UNANSWERABLE, and
not-applicable counts. A questionnaire returned with visible open items and a
named owner per item is a professional response. One returned complete and partly
invented is a liability.
7. Feed the library back
Every newly drafted answer, every SME correction and every gap goes back into the
library with its source and approval date. A response cycle that does not increase
the library repeats itself in full next quarter — that is the entire economics of
this skill.
Boundaries
- Not for assessing a vendor the organisation is buying from — that is
operations-vendor-evaluation, which sits on the other side of the same form.
- Not for the commercial, pricing and solution body of a bid — that is
sales-proposal-assembly.
- Not for negotiating the contract clauses the questionnaire feeds into —
that is
legal-compliance-contract-review.
- Not for writing the internal policy that would close a gap — that is
legal-compliance-policy-drafting.
- Not for determining whether a control satisfies an obligation of your
applicable regulator(s) — that assessment is
legal-compliance-regulatory-change-impact.
- Not for giving the legal opinion, certification or signature itself. This
skill prepares; a named authorised human attests.
Hand-offs
- Receives from:
sales-proposal-assembly (the security or compliance annex
of a bid); the security and compliance functions (evidence library updates).
- Routes to:
legal-compliance-policy-drafting when a gap needs a policy or
standard written to close it.
- Routes to:
legal-compliance-regulatory-change-impact when a question
reveals an obligation the control set does not meet.
- Routes to:
operations-vendor-evaluation when the same assessment is being
run in the outbound direction.
- Escalates to: counsel for anything privileged, disputed, or amounting to a
warranty; to the accountable officer for every signature.
1---2name: legal-compliance-questionnaire-response3description: Answers an inbound security questionnaire, vendor assessment, due diligence questionnaire or RFP compliance section from a maintained evidence library: every question mapped to a named source document, every answer marked SOURCED, NEEDS-SME or UNANSWERABLE, and anything amounting to a legal, security or regulatory attestation routed to the named human who is entitled to give it. Never composes a control the organisation does not demonstrably operate. Use when a prospect, client, counterparty, auditor or insurer sends a questionnaire, when an RFP contains a security or compliance annex, when a vendor assessment must be returned by a deadline, or when the answer library itself needs building or refreshing. Trigger on 'security questionnaire', 'DDQ', 'due diligence questionnaire', 'vendor assessment', 'RFP security section', 'SIG', 'client wants our controls', 'fill in this assessment'. Not for evaluating a vendor we are assessing (use operations-vendor-evaluation) and not for the commercial and pricing body of 4---56# Questionnaire and DDQ response78## Purpose910Questionnaire answers are contractual representations to a counterparty. They get11recycled from the last response, drift from what is actually operated, and one12plausible sentence about an encryption standard or a retention period becomes a13misrepresentation that surfaces during an incident or an audit. This skill makes14the evidence source, not the sentence, the unit of work: no answer exists until a15named document supports it, and questions without support are returned marked as16such rather than filled in.1718## Data classification1920**Confidential.** A completed questionnaire is a map of the organisation's21controls and its weaknesses. Treat drafts as restricted to the response team and22release only under the counterparty's NDA.2324**STOP CONDITIONS:**2526| Trigger | Action |27| --- | --- |28| The question asks for live secrets — keys, credentials, tokens, certificate private material, internal hostnames, IP ranges, or network diagrams at address level | Stop. These are never questionnaire answers. Offer the control description instead and route the request to the security function. |29| The question asks for unredacted findings from a penetration test, audit or incident report | Stop. Route to the security and legal owners; these are released under specific terms or summarised, not pasted. |30| Customer or employee personal data is pasted as an illustration | Stop. Ask for it to be removed; a questionnaire needs the control, not the record. |31| The questionnaire relates to an active dispute, investigation, enforcement action or litigation | Stop. Route to counsel before anything is drafted. Privilege and disclosure decisions come first. |32| The counterparty asks for a signed attestation, certification, warranty or officer sign-off | Stop drafting at the point of signature. Prepare the content; the signature is an authorised human act and is named, never assumed. |33| The user asks to answer "yes" because the control is planned, in progress, or on the roadmap | Stop. Planned is not implemented. Use the roadmap answer form in step 5 or mark it a gap. |3435**NON-FABRICATION RULE.** Never state that a control exists, a standard is met, a36certification is held, an audit was passed, a policy is in force, or a figure37(RTO, RPO, retention period, uptime, headcount, training completion) holds, unless38a supplied evidence source says so. Never carry an answer forward from a previous39response without re-verifying its source is current. Never infer a control from40the existence of a related one. Never soften an UNANSWERABLE into a hedge — "we41follow industry best practice" in place of a fact is an answer that will be read42as a commitment. Where evidence is missing, the output is43`UNANSWERABLE — no evidence source; assign to <function>`.4445An invented questionnaire answer is a misrepresentation to a counterparty. It is46relied on, it may be incorporated into a contract, and it survives in their file47for years.4849## Prerequisites5051- **Inputs (mandatory):** the questionnaire itself, complete, with the question52 numbering and any answer-format constraints (yes/no, free text, character53 limits, mandatory evidence attachments).54- **Inputs (mandatory):** the evidence library, or the documents standing in for55 it — policies, standards, certifications and their scope statements and expiry56 dates, audit reports, architecture descriptions, register extracts, prior57 approved answers with their approval dates.58- **Inputs (mandatory):** the scope of the engagement being assessed — which59 product, which entity, which jurisdiction, which data categories. Answers differ60 by scope, and a right answer about the wrong entity is a wrong answer.61- **Inputs (mandatory):** the named owners per domain — security, privacy,62 compliance, legal, HR, operations — and who is authorised to attest.63- **Inputs:** the return deadline and the counterparty's escalation contact.64- **Access:** the evidence repository, at read level. If the library does not65 exist yet, run step 1 and stop; there is nothing to answer from.6667If a mandatory input is missing, name it and stop.6869## Procedure7071### 1. Build or refresh the answer library before answering anything7273The library is the asset; the questionnaire is a query against it. Each entry:7475| Field | Why it exists |76| --- | --- |77| Control or topic | The thing being asserted |78| Approved answer text | The exact wording cleared for external release |79| Evidence source | Named document, version, section — not "our policy" |80| Evidence date and expiry | Certifications expire; an expired source is not a source |81| Scope qualifier | Which entity, product, environment and region it covers |82| Owner | The named function accountable for the assertion |83| Approval date and approver | When a human last confirmed it is still true |84| Release classification | Public, under NDA, or never released |8586An entry whose evidence is older than its review cycle is treated as87NEEDS-SME, not as SOURCED.8889### 2. Parse and normalise the questionnaire9091Number every question, including sub-parts, so nothing is answered by92association. Split compound questions — "do you encrypt data at rest and in93transit and manage keys in an HSM" is three assertions and may have three94different answers. Record required format per question; an essay in a yes/no95field is often scored as a non-answer.9697### 3. Classify each question before drafting9899| Class | Meaning | Handling |100| --- | --- | --- |101| Factual-sourced | An evidence entry answers it directly and in scope | Draft from the approved text; cite the source |102| Factual-adjacent | The library covers a neighbouring scope or an older version | NEEDS-SME. Do not stretch the scope qualifier |103| Attestation | Asserts legal, regulatory or security compliance, or requires signature | Route to the named authorised human. Draft content, never sign |104| Judgement | Asks for an opinion, a risk assessment, or a commitment about the future | Route to the domain owner; these are decisions, not lookups |105| Gap | The control genuinely does not exist or is partial | Step 5 |106| Out of scope | Concerns a product, entity or region not in the engagement | Answer "not applicable" **with the reason**; an unexplained N/A reads as evasion |107| Unanswerable | No evidence and no owner identified | Mark UNANSWERABLE and assign |108109### 4. Draft with the source attached to every answer110111Answer format: **the direct answer · the control described in operating terms ·112the evidence source and date · the scope qualifier.** Answer the question that was113asked, in the format requested, before adding context. Never exceed what the114evidence supports; if the policy says quarterly, the answer says quarterly, not115"regularly".116117### 5. Handle gaps honestly, because gaps are survivable and discovered lies are not118119A partial or absent control is stated as: what exists today · what does not · the120compensating control if there is one · whether remediation is committed, with a121date and an owner, and only if it is genuinely approved. Counterparties routinely122accept a disclosed gap with a plan. They do not accept discovering that an answer123was untrue, and neither does a regulator.124125### 6. Route the review before return126127| Answer class | Reviewer |128| --- | --- |129| Factual-sourced, unchanged from approved text | Response owner |130| Factual-sourced, reworded for this questionnaire | Domain owner |131| Attestation, legal or regulatory | Counsel or the accountable officer, named |132| Gap or remediation commitment | Domain owner plus the person who owns the plan |133| Anything referencing contractual terms, liability, indemnity or jurisdiction | Counsel |134135Return with a completeness statement: answered, NEEDS-SME, UNANSWERABLE, and136not-applicable counts. A questionnaire returned with visible open items and a137named owner per item is a professional response. One returned complete and partly138invented is a liability.139140### 7. Feed the library back141142Every newly drafted answer, every SME correction and every gap goes back into the143library with its source and approval date. A response cycle that does not increase144the library repeats itself in full next quarter — that is the entire economics of145this skill.146147## Boundaries148149- **Not for** assessing a vendor the organisation is buying from — that is150 `operations-vendor-evaluation`, which sits on the other side of the same form.151- **Not for** the commercial, pricing and solution body of a bid — that is152 `sales-proposal-assembly`.153- **Not for** negotiating the contract clauses the questionnaire feeds into —154 that is `legal-compliance-contract-review`.155- **Not for** writing the internal policy that would close a gap — that is156 `legal-compliance-policy-drafting`.157- **Not for** determining whether a control satisfies an obligation of your158 applicable regulator(s) — that assessment is159 `legal-compliance-regulatory-change-impact`.160- **Not for** giving the legal opinion, certification or signature itself. This161 skill prepares; a named authorised human attests.162163## Hand-offs164165- **Receives from:** `sales-proposal-assembly` (the security or compliance annex166 of a bid); the security and compliance functions (evidence library updates).167- **Routes to:** `legal-compliance-policy-drafting` when a gap needs a policy or168 standard written to close it.169- **Routes to:** `legal-compliance-regulatory-change-impact` when a question170 reveals an obligation the control set does not meet.171- **Routes to:** `operations-vendor-evaluation` when the same assessment is being172 run in the outbound direction.173- **Escalates to:** counsel for anything privileged, disputed, or amounting to a174 warranty; to the accountable officer for every signature.
alihusains