Security questionnaire automation that answers from your approved record, and lets your CISO delegate sign only what changed
Questionnaires back in days, not weeks, and every answer matches what customers were told.
See one case, screen by screen ↓Software that answers the security questionnaires customers send — SIG, CAIQ, HECVAT or their own — from a company's approved answers, policies and evidence, instead of by hand. Security Questionnaire Automation adds eight agents that read the questionnaire in any format, answer from the library or draft from current policy with every sentence cited, send what no source covers to the named expert, check each answer against what other customers were told, and return the customer's own file after the CISO delegate signs.
How to choose AI solutions for back-office and enterprise work →
Updated
A bank's third-party risk team will not release the contract until its questionnaire comes back: a SIG Lite, a CAIQ or a HECVAT, now with the bank's own DORA and AI tabs, in its own workbook, Word file, PDF or supplier portal. The GRC analyst and the sales engineer copy the questions out, hunt for what was answered last time, search the policies and chase the people who own backups, identity, privacy and AI by email. Then they paste the answers back and hope the template still works.
The bigger risk is the answer itself. A library answer is right on the day it is approved; then the retention standard is cut from 90 days to 30, and the library, the trust centre and the open questionnaires still say 90. Sales notes promise a 4-hour incident notice when the plan commits to 24. The CISO delegate cannot read 312 answers 150 times a year, so sign-off becomes a stamp. And under DORA Art. 30 and GDPR Art. 28, what goes back often becomes a contract representation.
Estimated split of hands-on hours for one large questionnaire, by hand and with the solution; by hand, the hours spread over weeks of waiting for experts.
Eight specialist agents read, match, draft, check and route every question; the CISO delegate signs only what is new or changed.
Atlas Crown Bank's third-party risk team sends Kestrel & Vane Group a 312-question SIG Lite 2026 with its own DORA ICT and AI use tabs. A $4.8M renewal of managed warehouse services waits on it, due Fri 23 Oct. Here is what happens next, screen by screen, in the working solution.
Jonah uploads ACB_TPRM_SIG-Lite-2026_KestrelVane.xlsx with the customer, opportunity OPP-28817, the due date and Amara Osei as owner. In 52 seconds the questionnaire reader recognises SIG Lite 2026 plus the two tabs the bank added, finds 3 visible tabs and 1 hidden one, and maps 312 questions, 312 answer cells, 302 Yes/No/N/A cells and 4 follow-ons behind a gate.
“1 hidden instruction set aside. A comment on cell D201 … is treated as text in the customer’s file and never followed. Logged on the audit trail.”
Amara opens one long grid in three bands: 271 from approved answers, 29 drafted from policies, 12 that need an expert. The ribbon shows each agent's work — reader, matcher, drafter, consistency, router, sign-off — and every row carries its source, its confidence and its state. 72% is already approved; the green band has 55 ready to approve in one click.
“Consistency · 3 to resolve” · “Router · 12 to 5 experts” · “Sign-off · 43 in packet”
“Do you encrypt backups at rest?” The library answer ANS-0233 was retired on 3 Sep 2026 when backups moved, so it was not reused. The drafter found Backup Policy v5.0 §4.2, wrote “Yes. All backups are encrypted at rest with AES-256; keys are held in the managed key service and rotated every 365 days”, checked each sentence against the passage and scored it 0.94, above the 0.80 floor. Every step of its plan is shown, with how long it took.
Below the 0.80 floor, a draft goes to the named expert instead.
Before Amara approves, the told-before tab lists the customers who received this answer since March — Brightmoor Health, Sorrel Medical, Fenwick Credit Union and others — each marked Same, with the date. The trust-centre statement says the same. The answer fits the bank's cell: 121 of 1,000 characters.
Library answer ANS-0377 says customer data is deleted 90 days after termination. The Data Retention Standard v3.2 §5.1, in force since 1 Jul 2026, says 30, and so does the trust centre — and 6 customers were told 90 days since July. One click on Fix everywhere updates the library answer, this questionnaire, Corvane Insurance's CAIQ and Marlow Transit's portal, and drafts a correction note to the 6 customers for their account owners.
Library answer ANS-0377 → v2 · “Owner Tomas Novak (DPO) approves in Teams.”
The bank asks for notice of a major ICT-related incident within 4 hours of detection. The Incident Response Plan v4.1 and the standard Data Processing Agreement commit to 24 hours from classification, and Jonah's deal notes of 6 Oct promised 4. The guard prepares three options with their consequences — keep 24 hours, offer 4 hours for this customer, or ask what the bank needs for its own reporting — and sends the decision to Ken Ito.
“Only the CISO delegate decides commitments above policy.”
Twelve questions went to five named experts at 16:47 on a 24-hour clock; ten came back overnight. Lucía sees only the questions asked of her. For the RTO and RPO of the warehouse management service, the router has drafted from runbook WMS-DR-07 and the 21 Aug 2026 recovery test: RTO 4 hours, RPO 15 minutes. She checks it against what Sorrel Medical was told and submits.
“Drafted by the router from the sources it found. Change anything; you are the source.”
The sign-off planner built Ken's delta packet: 29 policy drafts, 12 expert answers and 2 library answers that changed, each with its source. The 269 unchanged library answers he signed between 12 Nov 2025 and 30 Sep 2026, with no source changed since, he attests in one step. Any line can go back to Amara with a reason code; he approves the rest.
“Viewing as Ken Ito, Deputy CISO · he sees only what is new, changed or a promise.”
For the incident-notice commitment Ken chooses “Keep 24 hours (policy)” with reason code POL-COMMIT, and Jonah is told why. He attests the 269, adds his note — “Reviewed the delta packet; unchanged answers attested.” — and signs. The signature, the decision and the reason are on the audit trail.
“Signed by Ken Ito · Wed 14 Oct 11:52 … 43 approved · 269 attested · commitment DR-09: keep 24 hours (POL-COMMIT)”
The return writer writes the answers into the bank's own file, re-reads it and compares it with the original cell by cell: 312 answer cells and 302 Yes/No cells written, 0 other cells changed, 0 formulas or lists changed. The SOC 2 Type II report is attached because an NDA is on file; the internal retention standard is cited, never attached. Jonah marks it sent, OPP-28817 is updated and the 43 new or changed answers are proposed to the library.
“The hidden tab ‘Lists’, data validation and column widths are untouched. File type .xlsx → .xlsx.”
The same questionnaire, seen by the five people who carry it — what their week looked like, and what it looks like now.
Eight specialist agents read, match, draft, check and route every question; the CISO delegate signs only what is new or changed.
Reads Excel, Word, fillable and flat PDF and portal questionnaires; recognises the standard (SIG, CAIQ, HECVAT or the customer's own) and finds each question, the exact cell or field its answer goes in, its choice cell and any gate.
Matches each question to approved library answers and the ways the same question was asked before.
Drafts short, plain answers from current policies, standards, reports and certificates, cites every sentence and checks each one against its passage.
Checks every answer against what other customers were told, the trust centre and the policy in force, and proposes one fix everywhere with a correction list for customers told something else.
Finds answers that are promises — notice periods, RTOs, audit rights, data locations — compares them with policy, the standard DPA and the deal notes, and prepares the options.
Sends each question no source covers to the named topic owner in Microsoft Teams or Slack, with what was found so far, and runs the 24-hour clock with reminders and escalation.
Builds the delta packet of new, changed and promised answers, and the attestation for unchanged answers the delegate signed within the re-sign limit.
Writes the answers into the customer's own file or portal, re-reads it to prove only answer cells changed, attaches evidence under the NDA rules and proposes new answers to the library.
Signs only what is new or changed. The agents propose; a named person decides.
Ask in plain words, or say what to do. The assistant answers with its sources and opens the screen where you act.
What did we tell other customers about data retention after termination?
Two different things. The policy in force since 1 Jul 2026 says customer data is deleted within 30 days of contract end, and so does the trust centre. But library answer ANS-0377 still says 90 days, and 6 customers were told that since July. I have opened the consistency finding with the fix ready.
What is left before Atlas Crown Bank can go back?
72% is approved. Left: 2 expert answers from Lucía Ferrer (due 16:47), 2 stale library answers to fix, the 4-hour notice commitment for Ken Ito, and Ken's sign-off of the 43 new or changed answers. The due date is Fri 23 Oct, so there are 9 days in hand. I have filtered the grid to what needs you.
Which answers relied on the old Backup Policy?
Backup Policy v4.3 was replaced by v5.0 on 28 Aug 2026, and 11 library answers moved with it. ANS-0233 was retired because it described the old backup appliance. On Atlas Crown Bank, OR-07 is drafted from v5.0 §4.2: AES-256, keys in the managed key service, rotated every 365 days. That matches what 14 customers were told.
Remind every expert with an answer due today
Done. I reminded Lucía Ferrer in Teams about OR-11 and DR-22 (due 16:47) and attached the runbook passage I found. I also reminded Sana Qureshi and Oliver Brandt, who are late on Corvane Insurance and Tamsin Foods. All three reminders are on the audit trail.
13 screens from the working solution, on its sample data. Pick one to see it large.
How sure an answer must be, who approves each topic and how long an expert has are settings, saved and on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Library match floor | 0.90 | A slider from 0.80 to 0.99 |
| Draft confidence floor | 0.80 | A slider from 0.60 to 0.95; below it, the question goes to the named expert |
| Re-sign library answers after | 12 months | A slider from 6 to 24 months |
| Commitments above policy | Always to the CISO delegate | Notice periods, RTOs, audit rights, locations |
| Hidden text in customer files | Read as data, never followed | Comments, hidden tabs, white or tiny text |
| Expert answer time | 24 hours | 24 hours · Off; reminder at 16 hours, escalation to the expert's manager at 36 hours |
| Who approves each sensitive topic | Privacy and data location: Tomas Novak | Ken Ito · Tomas Novak · Sana Qureshi · Ravi Menon · Lucía Ferrer · Oliver Brandt |
| Signs every questionnaire | Ken Ito | Ken Ito · Group CISO |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample questionnaire data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published vendor figures, directional (50–200 security questionnaires a year, 150+ at enterprises, at $700–$2,000 of sales engineering and GRC labour each; 2–6 weeks of deal delay per questionnaire answered by hand). Regulation as context: DORA Art. 28 and 30, GDPR Art. 28. Kestrel & Vane Group, Atlas Crown Bank, the other customers and the people named on this page are fictional: characters and sample data in the working solution.
Software that answers the security questionnaires customers send — SIG, CAIQ, HECVAT or their own — from a company's approved answers, policies and evidence, instead of by hand. Security Questionnaire Automation adds eight agents that read the questionnaire in any format, answer from the library or draft from current policy with every sentence cited, send what no source covers to the named expert, check each answer against what other customers were told, and return the customer's own file after the CISO delegate signs.
The questionnaire reader recognises the standard and maps every question to its answer cell. The library matcher reuses approved answers above a 0.90 match that were signed in the last 12 months; the policy drafter drafts the rest from current policies with each sentence cited; below 0.80 confidence the question goes to the expert who owns the topic. In the sample, 300 of 312 questions were drafted by agents.
Yes. The consistency checker compares every answer with what other customers were told, the trust centre and the policy in force. When a library answer is stale it proposes one fix everywhere — the library, the trust centre and open questionnaires — and a correction list for the customers who were told the old answer, for the answer's owner to approve.
The commitment guard finds answers that are promises, such as incident-notice periods, RTOs, audit rights and data locations, and compares them with the policy, the standard contract and the deal notes. Anything above policy goes to the CISO delegate with the options and their consequences, and is decided with a reason code.
No. The sign-off planner builds a packet of only what is new, changed or a promise — 43 of 312 in the sample — and the CISO delegate attests the unchanged answers he signed within the re-sign limit in one step. Every line keeps its source and history.
Yes. The return writer writes the answers into the customer's own workbook, Word file or PDF, re-reads it and proves that only the answer cells changed. For a portal it fills the fields and leaves Submit to a person. Evidence such as a SOC 2 report is attached only when an NDA is on file.
Yes. Experts answer their own questions and the agents never answer for them. Analysts and topic approvers approve, the CISO delegate signs, nothing is returned before sign-off, and instructions hidden in a customer's file are set aside and logged, never followed.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your answer library, policies, evidence and a sample of past questionnaires — and it goes live once every quality gate has passed. We will walk you through it on one of your own questionnaires first.
Higher win rate, no promise you can't keep, and the bid in on time.
1-min demoDue Diligence Questionnaire (DDQ) ResponseEvery DDQ answered from approved sources, and no investor told two different stories.
1-min demoRFP Compliance MatrixEvery shall answered and cited before red team, so no bid is lost on compliance.
1-min demoWe'll run Security Questionnaire Automation on one of your own past questionnaires, against your answer library and policies.