Official skill · Legal basics
Security questionnaire answers
Drafts answers to a customer security questionnaire from your own policies and facts, marks unknowns with owners, and never overclaims certifications. Use it when A prospect's procurement team sends a security questionnaire.
AI skill
Have your AI draft answers to a security questionnaire
14 days free · No card needed
Works in Claude, ChatGPT, and coding agents. On Team and Business, the official skill in your pod updates itself when we improve it.
When to use it
- A prospect's procurement team sends a security questionnaire
- A renewal comes with an updated vendor assessment
What you give it
- The questions with their numbering
- Your policies, reports, and stated facts
- Owners for open items
What you get
An answer table with evidence for each line, an open items list with owners, and commitments to confirm with counsel.
How it works
- Index the evidence
- Recognize the format
- Sort the questions
- Draft yes/no answers strictly
- Never overclaim certifications
- Keep each answer short
- Flag contractual promises
- Write the answer sheet and the open items
Example
What you give it
Mei at Brightloop (a scheduling app) gets 5 questions from Ostara Insurance. Evidence: "Access policy v3 (June 2026): SSO with MFA for all staff on admin tools; access reviewed quarterly." User says: "We're on AWS in Ireland. No SOC 2 yet, we started with an auditor in September. We have backups daily." > 1. Do you hold a SOC 2 Type II report? > 2. Is MFA enforced for all administrative access? > 3. Where is customer data stored? > 4. Do you encrypt data at rest? > 5. Will you notify us of a breach within 24 hours?
What you get back (the start of it)
Security questionnaire — Ostara Insurance, 4 November
_Not legal advice. Answers drafted from the evidence listed; review before sending._
Evidence used
- [E1] Access policy v3, June 2026
- [E2] Mei's statements, 4 November 2026
Answers
| # | Question | Answer | Detail | Evidence |
|---|---|---|---|---|
| 1 | SOC 2 Type II report | No | Brightloop does not hold a SOC 2 report. An audit engagement started in September 2026. | [E2] |
| 2 | MFA on admin access | Yes | All staff reach admin tools through SSO with MFA. Access is reviewed quarterly. | [E1] |
| 3 | Data location | Yes | Customer data is stored on AWS in Ireland. | [E2] |
| 4 | Encryption at rest | Unknown | Not covered by the evidence. | — |
| 5 | Breach notice in 24 hours | Unknown | No incident policy provided. [commitment: confirm with counsel] | — |
The rest of this output, the full steps and the checks the AI runs before it answers are in your pod once you add the skill.
Use this skill in your AIShare it with your team
Add it to an AI Skill Pod and everyone on the team, contractors included, uses the same version from their own AI. Read the best ways to share AI skills with a team
Changelog
- v1.0.1 · · Disclaimer: a first-pass draft, since the skill drafts answers.
- v1.0.0 · · First release.
Sources
- SOC 2 (AICPA & CIMA) (read 2026-11-04)
- STAR Level 1: Security Questionnaire (CAIQ v4.1) | CSA (read 2026-11-04)
- Shared Responsibility Model | AWS (read 2026-11-04)