legal-compliance-questionnaire-responselisted

Answers an inbound security questionnaire, vendor assessment, due diligence questionnaire or RFP compliance section from a maintained evidence library: every question mapped to a named source document, every answer marked SOURCED, NEEDS-SME or UNANSWERABLE, and anything amounting to a legal, security or regulatory attestation routed to the named human who is entitled to give it. Never composes a control the organisation does not demonstrably operate. Use when a prospect, client, counterparty, auditor or insurer sends a questionnaire, when an RFP contains a security or compliance annex, when a vendor assessment must be returned by a deadline, or when the answer library itself needs building or refreshing. Trigger on 'security questionnaire', 'DDQ', 'due diligence questionnaire', 'vendor assessment', 'RFP security section', 'SIG', 'client wants our controls', 'fill in this assessment'. Not for evaluating a vendor we are assessing (use operations-vendor-evaluation) and not for the commercial and pricing body of
alihusains/enterprise-skills · ★ 0 · AI & Automation · score 73

Install: claude install-skill alihusains/enterprise-skills

# Questionnaire and DDQ response ## Purpose Questionnaire answers are contractual representations to a counterparty. They get recycled from the last response, drift from what is actually operated, and one plausible sentence about an encryption standard or a retention period becomes a misrepresentation that surfaces during an incident or an audit. This skill makes the evidence source, not the sentence, the unit of work: no answer exists until a named document supports it, and questions without support are returned marked as such rather than filled in. ## Data classification **Confidential.** A completed questionnaire is a map of the organisation's controls and its weaknesses. Treat drafts as restricted to the response team and release only under the counterparty's NDA. **STOP CONDITIONS:** | Trigger | Action | | --- | --- | | The question asks for live secrets — keys, credentials, tokens, certificate private material, internal hostnames, IP ranges, or network diagrams at address level | Stop. These are never questionnaire answers. Offer the control description instead and route the request to the security function. | | The question asks for unredacted findings from a penetration test, audit or incident report | Stop. Route to the security and legal owners; these are released under specific terms or summarised, not pasted. | | Customer or employee personal data is pasted as an illustration | Stop. Ask for it to be removed; a questionnaire needs the control, not the record