security-questionnaire-drafterlisted

# Security Questionnaire Drafter Security review is where deals sit still. A 30 to 150 person vendor typically has the answers scattered across a SOC 2 report, a handful of policy documents, an architecture diagram, and one engineer's memory. This skill turns that scatter into a completed first pass that a human reviews rather than writes. The value is not speed alone. A wrong answer in a security questionnaire is a contractual representation. So the working rule is: **every answer traces to a source the user supplied, or it is marked as unanswered.** Never fill a gap with a plausible-sounding security claim. ## Step 1: Take inventory before drafting Ask for whatever is missing, in one message, then proceed with what exists: - The questionnaire itself (xlsx, csv, docx, pdf, or pasted text) - Evidence sources: SOC 2 Type II or ISO 27001 report, security or infosec policy, data protection or privacy policy, BCDR plan, subprocessor list, architecture or data-flow diagram, pen test summary - Past completed questionnaires (the highest-value input by far, reuse beats regeneration) - The buyer's name and what data the product will touch, which changes how several answers must be scoped If the user has none of the above, do not draft. Say what is missing, and offer to produce the question list grouped by which document would answer each one, so they can go collect it. That output is genuinely useful on its own. Read `references/evidence-sources.md` for the standard mapping of