Security Questionnaire Answer Library

About the Security Questionnaire Answer Library

Customers send security questionnaires before they buy: a spreadsheet of 50 to 500 questions about access control, encryption, backups, incidents, suppliers and certifications. Most of the questions were asked before in other words. This tool keeps your approved answers in a library and, for each new questionnaire, proposes the closest answer for every question with a High, Medium or Low confidence, so you review instead of writing.

Build the library from questionnaires you have already answered (any sheet with a question and an answer column), or add answers one by one with their details, evidence, owner and review date. Then import the customer’s questionnaire, or paste its questions from a web form. Accept the close matches, check the others, and add what is new to the library for next time.

The free preview matches every question and shows the counts and the first questions with their answers. With a Premium pass you get the answered questionnaire: the customer’s own Excel file with your answers in its answer and comment columns and its formatting kept, plus a review workbook with the evidence list. The library itself is your own input and never locked. Nothing is uploaded.

Common uses

• Answering customer security and vendor due-diligence questionnaires in days instead of weeks.
• Filling CAIQ-style, SIG-style or a customer’s own Excel questionnaire without retyping answers.
• Keeping one approved set of security answers for sales, the security team and leadership.
• Preparing the evidence list (policies, reports, certificates) a questionnaire refers to.

How the matching works

Each question is compared with every approved answer’s question and its other wordings. Words are reduced to a simple stem (reviews, reviewed and reviewing meet), common security terms are folded together (MFA and two-factor; SSO and SAML; TLS and encryption in transit; vendors, suppliers and subprocessors; penetration tests and pentests), and the words a questionnaire always uses (“please describe”, “do you”) count for nothing. The score weighs rare words more than common ones and adds a bonus for shared word pairs; a security term the question asks about and the answer does not mention lowers it.

• High: the same question in other words. Usually right; still read it before it goes out.
• Medium: the same topic. Check that the answer covers what this question asks.
• Low: a guess. Often a different question about the same subject.
• No match: write the answer and save it to the library.

Only answers marked Approved are proposed; drafts stay out until they are approved.

What you get

• The answered questionnaire: for .xlsx and .xlsm files, the customer’s own workbook with each accepted or edited answer written into its cell, keeping the cell’s style, the other sheets, drop-down lists and macros. CSV and TSV files keep their delimiter; .xls and .ods files are saved as .xlsx. Questions still to review and rejected ones stay as they were.
• The review workbook: every question with its status, confidence, the library answer it came from, the answer’s owner and review date, and the evidence list: each policy, report or certificate the answers point to, with the questions it supports.
• The answers as text, question by question, for web forms and e-mails, and a Copy button on each question.

Keeping the library up to date

Give every answer an owner and a review date: the library shows which answers are past their date, and the review workbook lists both, so stale answers do not go out unnoticed. When a policy, a certification or a supplier changes, search the library for the answers that mention it. Teams share a library as its backup file or as the Library as Excel sheet, which reads back with Import answers, other wordings and drafts included. A good library answers in two parts: a short answer that fits a Yes/No column, and details for the comment column.

Questionnaire formats

Customers often send a standard questionnaire, or their own sheet built from one. The tool reads the file the customer sent you and reproduces none of these questionnaires itself:

• Cloud Security Alliance: CAIQ v4, yes-or-no questions about the security controls of a cloud service, checked against the Cloud Controls Matrix.
• Shared Assessments: SIG, a questionnaire for third-party risk assessments that Shared Assessments licenses.
• A customer’s own Excel or CSV sheet: any sheet with a column of questions, with or without answer and comment columns.

Limitations

• It proposes only answers you already wrote; a new topic needs a new answer.
• Matching compares words, not meaning: a familiar-looking question that asks something else can get a Medium or Low match, so read every proposal before you send it.
• English questions match best: the stems and security terms are English.
• Cells that hold formulas are left unchanged, and the formatting of .xls and .ods files may be simplified when they are saved as .xlsx.
• An answer is a statement to a customer and may become part of a contract: keep it true, current and approved by its owner.

Privacy

Questionnaires and libraries are read in this browser and never uploaded. A questionnaire is not kept after you close the page; the library is kept in this browser only when you tick Keep the library in this browser, and otherwise lives in the backup files you save.