# Legal Compliance Questionnaire Response > Answers an inbound security questionnaire, vendor assessment, due diligence questionnaire or RFP compliance section from a maintained evidence library: every question mapped to a named source document, every answer marked SOURCED, NEEDS-SME or UNANSWERABLE, and anything amounting to a legal, security or regulatory attestation routed to the named human who is entitled to give it. Never composes a control the organisation does not demonstrably operate. Use when a prospect, client, counterparty, auditor or insurer sends a questionnaire, when an RFP contains a security or compliance annex, when a vendor assessment must be returned by a deadline, or when the answer library itself needs building or refreshing. Trigger on 'security questionnaire', 'DDQ', 'due diligence questionnaire', 'vendor assessment', 'RFP security section', 'SIG', 'client wants our controls', 'fill in this assessment'. Not for evaluating a vendor we are assessing (use operations-vendor-evaluation) and not for the commercial and pricing body of - Skill: `alihusains/legal-compliance-questionnaire-response` (Agent Skill) - Install (CLI): `npx skillmds@latest add alihusains/legal-compliance-questionnaire-response` - Raw SKILL.md: https://api.skillmd.com/api/skills/alihusains/legal-compliance-questionnaire-response/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: alihusains (https://skillmd.com/u/alihusains) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/alihusains/legal-compliance-questionnaire-response --- # Questionnaire and DDQ response ## Purpose Questionnaire answers are contractual representations to a counterparty. They get recycled from the last response, drift from what is actually operated, and one plausible sentence about an encryption standard or a retention period becomes a misrepresentation that surfaces during an incident or an audit. This skill makes the evidence source, not the sentence, the unit of work: no answer exists until a named document supports it, and questions without support are returned marked as such rather than filled in. ## Data classification **Confidential.** A completed questionnaire is a map of the organisation's controls and its weaknesses. Treat drafts as restricted to the response team and release only under the counterparty's NDA. **STOP CONDITIONS:** | Trigger | Action | | --- | --- | | The question asks for live secrets — keys, credentials, tokens, certificate private material, internal hostnames, IP ranges, or network diagrams at address level | Stop. These are never questionnaire answers. Offer the control description instead and route the request to the security function. | | The question asks for unredacted findings from a penetration test, audit or incident report | Stop. Route to the security and legal owners; these are released under specific terms or summarised, not pasted. | | Customer or employee personal data is pasted as an illustration | Stop. Ask for it to be removed; a questionnaire needs the control, not the record. | | The questionnaire relates to an active dispute, investigation, enforcement action or litigation | Stop. Route to counsel before anything is drafted. Privilege and disclosure decisions come first. | | The counterparty asks for a signed attestation, certification, warranty or officer sign-off | Stop drafting at the point of signature. Prepare the content; the signature is an authorised human act and is named, never assumed. | | The user asks to answer "yes" because the control is planned, in progress, or on the roadmap | Stop. Planned is not implemented. Use the roadmap answer form in step 5 or mark it a gap. | **NON-FABRICATION RULE.** Never state that a control exists, a standard is met, a certification is held, an audit was passed, a policy is in force, or a figure (RTO, RPO, retention period, uptime, headcount, training completion) holds, unless a supplied evidence source says so. Never carry an answer forward from a previous response without re-verifying its source is current. Never infer a control from the existence of a related one. Never soften an UNANSWERABLE into a hedge — "we follow industry best practice" in place of a fact is an answer that will be read as a commitment. Where evidence is missing, the output is `UNANSWERABLE — no evidence source; assign to `. An invented questionnaire answer is a misrepresentation to a counterparty. It is relied on, it may be incorporated into a contract, and it survives in their file for years. ## Prerequisites - **Inputs (mandatory):** the questionnaire itself, complete, with the question numbering and any answer-format constraints (yes/no, free text, character limits, mandatory evidence attachments). - **Inputs (mandatory):** the evidence library, or the documents standing in for it — policies, standards, certifications and their scope statements and expiry dates, audit reports, architecture descriptions, register extracts, prior approved answers with their approval dates. - **Inputs (mandatory):** the scope of the engagement being assessed — which product, which entity, which jurisdiction, which data categories. Answers differ by scope, and a right answer about the wrong entity is a wrong answer. - **Inputs (mandatory):** the named owners per domain — security, privacy, compliance, legal, HR, operations — and who is authorised to attest. - **Inputs:** the return deadline and the counterparty's escalation contact. - **Access:** the evidence repository, at read level. If the library does not exist yet, run step 1 and stop; there is nothing to answer from. If a mandatory input is missing, name it and stop. ## Procedure ### 1. Build or refresh the answer library before answering anything The library is the asset; the questionnaire is a query against it. Each entry: | Field | Why it exists | | --- | --- | | Control or topic | The thing being asserted | | Approved answer text | The exact wording cleared for external release | | Evidence source | Named document, version, section — not "our policy" | | Evidence date and expiry | Certifications expire; an expired source is not a source | | Scope qualifier | Which entity, product, environment and region it covers | | Owner | The named function accountable for the assertion | | Approval date and approver | When a human last confirmed it is still true | | Release classification | Public, under NDA, or never released | An entry whose evidence is older than its review cycle is treated as NEEDS-SME, not as SOURCED. ### 2. Parse and normalise the questionnaire Number every question, including sub-parts, so nothing is answered by association. Split compound questions — "do you encrypt data at rest and in transit and manage keys in an HSM" is three assertions and may have three different answers. Record required format per question; an essay in a yes/no field is often scored as a non-answer. ### 3. Classify each question before drafting | Class | Meaning | Handling | | --- | --- | --- | | Factual-sourced | An evidence entry answers it directly and in scope | Draft from the approved text; cite the source | | Factual-adjacent | The library covers a neighbouring scope or an older version | NEEDS-SME. Do not stretch the scope qualifier | | Attestation | Asserts legal, regulatory or security compliance, or requires signature | Route to the named authorised human. Draft content, never sign | | Judgement | Asks for an opinion, a risk assessment, or a commitment about the future | Route to the domain owner; these are decisions, not lookups | | Gap | The control genuinely does not exist or is partial | Step 5 | | Out of scope | Concerns a product, entity or region not in the engagement | Answer "not applicable" **with the reason**; an unexplained N/A reads as evasion | | Unanswerable | No evidence and no owner identified | Mark UNANSWERABLE and assign | ### 4. Draft with the source attached to every answer Answer format: **the direct answer · the control described in operating terms · the evidence source and date · the scope qualifier.** Answer the question that was asked, in the format requested, before adding context. Never exceed what the evidence supports; if the policy says quarterly, the answer says quarterly, not "regularly". ### 5. Handle gaps honestly, because gaps are survivable and discovered lies are not A partial or absent control is stated as: what exists today · what does not · the compensating control if there is one · whether remediation is committed, with a date and an owner, and only if it is genuinely approved. Counterparties routinely accept a disclosed gap with a plan. They do not accept discovering that an answer was untrue, and neither does a regulator. ### 6. Route the review before return | Answer class | Reviewer | | --- | --- | | Factual-sourced, unchanged from approved text | Response owner | | Factual-sourced, reworded for this questionnaire | Domain owner | | Attestation, legal or regulatory | Counsel or the accountable officer, named | | Gap or remediation commitment | Domain owner plus the person who owns the plan | | Anything referencing contractual terms, liability, indemnity or jurisdiction | Counsel | Return with a completeness statement: answered, NEEDS-SME, UNANSWERABLE, and not-applicable counts. A questionnaire returned with visible open items and a named owner per item is a professional response. One returned complete and partly invented is a liability. ### 7. Feed the library back Every newly drafted answer, every SME correction and every gap goes back into the library with its source and approval date. A response cycle that does not increase the library repeats itself in full next quarter — that is the entire economics of this skill. ## Boundaries - **Not for** assessing a vendor the organisation is buying from — that is `operations-vendor-evaluation`, which sits on the other side of the same form. - **Not for** the commercial, pricing and solution body of a bid — that is `sales-proposal-assembly`. - **Not for** negotiating the contract clauses the questionnaire feeds into — that is `legal-compliance-contract-review`. - **Not for** writing the internal policy that would close a gap — that is `legal-compliance-policy-drafting`. - **Not for** determining whether a control satisfies an obligation of your applicable regulator(s) — that assessment is `legal-compliance-regulatory-change-impact`. - **Not for** giving the legal opinion, certification or signature itself. This skill prepares; a named authorised human attests. ## Hand-offs - **Receives from:** `sales-proposal-assembly` (the security or compliance annex of a bid); the security and compliance functions (evidence library updates). - **Routes to:** `legal-compliance-policy-drafting` when a gap needs a policy or standard written to close it. - **Routes to:** `legal-compliance-regulatory-change-impact` when a question reveals an obligation the control set does not meet. - **Routes to:** `operations-vendor-evaluation` when the same assessment is being run in the outbound direction. - **Escalates to:** counsel for anything privileged, disputed, or amounting to a warranty; to the accountable officer for every signature.