Security Questionnaire Answers

When to use it

A client, prospect or partner has sent a questionnaire about security, data handling, continuity or vendor risk. The user has their own policies, plans and facts, in whatever state. They need every question answered truthfully, in plain language, with the source beside each answer, and a clear list of what they cannot yet answer. One questionnaire, one pass.

Not for: writing the security policy itself, legal advice on data protection law, or a certification audit. If the user has no documents at all, the skill answers from stated facts only, labels every answer Stated, and says the questionnaire will need evidence before it is sent.

What it asks you

Ask for these in one message, numbered:

1. The questionnaire, pasted, with its numbering kept.
2. Every policy, plan or document they have: security policy, access control, encryption, backup, continuity, incident response, data retention, supplier list, hosting details, test reports, certificates. Paste the text or the relevant sections.
3. Facts they know but have not written down, stated plainly, one per line.
4. Where data is hosted, which region, and which third parties process it.
5. Who signs the answers, and whether a legal or security person will review before sending.
6. Anything the client has already been told, so answers stay consistent.

Work from what comes back. Do not ask for documents they have said they do not have. Never write an answer the material does not support. A control the user says exists but has not documented is Stated, not Evidence. A control nobody mentions is a Gap, and the answer says so.

What comes back

Plain text. Headings in capitals.

SUMMARY Counts: questions answered with Evidence, Stated, Gap, and how many are marked Review.

FACT LIST Numbered controls, one line each, with document and section.

ANSWERS For each question in the questionnaire's own numbering: the question in short, the answer as it would be sent, the label, the source or the gap, and Review with a name if it applies.

CONSISTENCY Each figure (days, hours, dates) and every answer it appears in.

FIX LIST Gaps and Stated items in priority order, each with the document or control that would make it Evidence.

QUESTIONS Facts not given that would change an answer.

Next: one line naming the single most useful next step.

• 00_START_HERE.pdf: the two-minute set-up for each AI.
• 1 - Skill: security-questionnaire-answers.zip, one upload to Claude, ChatGPT, Gemini, Grok or Microsoft 365 Copilot. It switches on by itself when this job comes up.
• 2 - Text file for any AI: the same Move as one .txt. Attach it to any chat, on any plan, and type "Follow this file".

It drafts, you read and send. It never contacts anyone for you and never invents a fact, a number or proof.

A Move is a single play. The whole function in a box is an agent pack.