Security questionnaire answers

Use this for a customer questionnaire, a SIG, a CAIQ, or a portal form.

Match questions to evidence

Count the questions and check the import is complete. For each question find the policy, report, config export, or approved past answer that covers it. Reuse a past answer only when the question truly asks the same thing and the evidence behind it is still current.

Draft the answers

For each answer give:

• the answer: yes, no, partial, or not applicable;
• one or two plain sentences of detail;
• the source document, version, and section;
• the date of the evidence.

Answer "partial" when a control covers some systems and not others, and say which. Do not soften a "no" into a vague yes.

Gaps and owners

List every question the evidence does not answer, with the owner who can, and the owner-approved date to ask by. If no date was supplied, mark it unknown and ask the owner to set it. Keep legal questions (liability, legal basis, breach terms) on a separate list for counsel. Give counts: answered, partial, gap.

Never answer yes to a certification, control, or audit result without evidence; mark it as a gap. This is not legal advice. Do not submit the questionnaire or send it; the owner reviews and submits.