Security Questionnaire Responder

The problem

Security questionnaires and RFPs consume hours of manual work from sales engineers and founders. Copy-pasting from old spreadsheets is error-prone, risks inconsistent answers, and hides missing gaps until the last minute.

What it does

• Parses inbound .xlsx, .csv, and .docx questionnaires to identify question and response fields.
• Maps questions to a centralized markdown answer bank using framework-specific logic for SIG, CAIQ, and SOC 2.
• Populates the original file with formatted responses while maintaining the buyer's layout.
• Generates a reviewer report flagging gaps, stale data, and potential contradictions for human sign-off.
• Updates the local answer bank with new Q&A pairs to improve future response accuracy.

Frameworks & tools

Python scripts for file manipulation, Markdown for the knowledge base, and support for SIG, CAIQ, CIS, SOC 2, and ISO 27001 mapping.

Why this beats prompting it yourself

Standard LLM prompts often hallucinate security postures or miss internal contradictions. This skill enforces a "never guess" policy, strictly deriving answers from your verified bank and providing a structured audit trail for every response.

Use cases

• Automating the security section of a large enterprise RFI or RFP.
• Completing annual vendor risk assessments for existing enterprise customers.
• Mapping internal security controls to specific framework requirements like CAIQ or SIG.
• Maintaining a single source of truth for company security facts and certifications.

Known limitations

Does not generate evidence documents like SOC 2 reports or network diagrams. Legal terms and DPA clauses are flagged for legal review rather than answered.