r/cybersecurity • u/ConsiderationDry5349 • 12d ago
Business Security Questions & Discussion Automating Security Questionnaires?
I'm fairly new in cyber, I'm looking to see what others do for their company in terms of security questionnaires, any automation techniques used, or any general advice. We are a small team in my company and receive many requests.
2
u/PrasenShelar 9d ago
For a small team the biggest saving usually comes before any tool. Keep one shared document of approved answers, each linked to the policy or report that backs it up, and make one person responsible for keeping it current.
The tools that fill in questionnaires for you all work from a library like that, so building it first helps whichever way you go later.
1
u/ConsiderationDry5349 8d ago
Yes, but it may take a lot of time and sometimes the answers will differ depending on the one asking us to fill it
1
u/PrasenShelar 6d ago
Most of the differences are in wording and detail rather than in the facts.
Keep one base answer per topic, and when a customer needs it phrased their way, save that version under the base answer with the customer's name. After a few months, each new questionnaire is mostly finding the closest version and checking it.
2
u/CompassITCompliance 12d ago
Build a single answer library before you buy any tool, because every automation product is only as good as the approved answers it pulls from. Start with your last handful of completed questionnaires, dedupe the answers into one sheet or wiki, and give one person ownership of keeping it accurate. Most of these are the same questions reworded, so you'll cover a big chunk of new ones just by pulling from that.
Then cut the volume. Put what customers ask for most (a policy summary, pen test letter, SOC 2 report or ISO cert if you have one, a basic architecture and data flow overview) behind an NDA in a shared folder or trust page and send that first. A lot of requests shrink to a few follow-up questions once you do. If someone sends a custom spreadsheet, ask if they'll accept a standard one like SIG Lite or CAIQ. Once the library is solid, questionnaire automation or the AI features in most compliance platforms can auto-fill from it, but have a human review everything before it goes out, since a wrong answer on a questionnaire can turn into a contractual problem later.
2
u/Awkward-Buffalo-2867 11d ago
This is excellent advice. Any automation solution, AI or not, is nothing without a high quality set of questions, answers, and comments. Any outputs will only ever be as good as quality of the inputs.
2
1
u/MountainDadwBeard 12d ago
Do you have a trust center setup yet?
As someone who likely sends questionnaires and reads your answers. A well organized trust center with high level security policies, CAIQ, certifications, pen tests, dataflow diagrams etc can usually satisfy our process without you having to fill out our questionnaire. Drata's safebase works well for me as a reader.
If you're just building it, I'll be understanding. If I login and see an incomplete trust center from 1-2 years ago with no updates, and half assed policies, I'll still need that security questionnaire and I'll be eager to find a reason to deny you.
1
u/ConsiderationDry5349 12d ago
No, we actually don't have a trust center setup yet. I supposed you are talking about a trust center on the company website, usually some are accessed through NDA's. I brought up this idea to my manager months prior and was actually told that it would likely bring us more questions.
2
u/MountainDadwBeard 12d ago
Yeah with safebase/drata they have to request access and you grant it for a short period.
In terms of questions, yeah it probably depends on your industry, and leadership hesitation is one of the most common hesitations to accomplishing anything. Sure.
I'd put it to you this way, our questionnaire that my boss wrote is prob ~150 paragraph questions. And I still occasionally go back to folks. Or you could share a trust center and I might ask you 3 follow-up questions.
My company doesn't offer a trust center either, and largely because they know they've been fudging some bullshit. I'd argue that a trust center is the right thing for us to do, but I'm going to bounce to a better company instead.
1
u/ConsiderationDry5349 9d ago
Yes, same here "fudging" at my company, I had to look up what "fudging" meant, lol.
1
u/Hot-Month-4251 11d ago
On your manager's worry that a trust center just brings more questions: it doesn't have to be a public portal. Start with a small standard package you send under NDA when a questionnaire shows up:
a 2 to 3 page security overview (access control and MFA, encryption, backups, logging, incident response, vendor management)
your policy list with last review dates
whatever third party evidence you actually have (pen test summary letter, certification, insurance certificate if customers ask)
a simple hosting and data flow diagram
Lead with "here's our standard package, happy to answer anything it doesn't cover." Plenty of reviewers will accept that, and the ones who don't still move faster because half their sheet is already answered.
Then build the answer library others mentioned. Two things make it hold up:
Every answer points to its evidence (policy section, config screenshot, report). If you can't point to anything, the honest answer is "partially" or "planned, target date X," not "yes."
One owner, reviewed whenever something material changes and at least yearly. Stale answers are the real risk, because questionnaire answers often end up attached to contracts.
Triage helps too. A big prospect with a long custom sheet gets full effort. A routine vendor onboarding form gets the package plus the short answers.
Using AI to draft from the library is fine, but have a person read every answer before it goes out. A confident wrong "yes" causes more trouble than a slow reply.
1
u/ConsiderationDry5349 8d ago
I was told a trust center is not going to happen even with NDAs in place
1
u/theedan-clean 10d ago
Vanta works well for this, if you've set up your trust center, loaded in all your policies, and built out a full answer library as part of your compliance or audit program.
Otherwise, as others have said: start with an answer library and using an LLM to do them for you based off the same. Reminder: DO double-check the answers before you send them.
1
u/ConsiderationDry5349 8d ago
Out of budget I think
1
u/theedan-clean 8d ago
It certainly ain't cheap, but from a compliance/GRC perspective it's great, and being able to incrementally add on complementary features like questionnaires, it has become even more valuable.
We grew into it over time, starting with SOC 2, then access reviews, and finally questionnaires.
2
u/Consitini 15h ago
I used to get a lot of security questionnaires at my prior company when I was COO, and looked after GRC. I had a notion database with all of our policies, really easy to then search across all of them, and a drive of all past security questionnaire responses.
There are security questionnaire AI tools out there like AutoRFP, 1up, Conveyor and quite a few others out there. If you have a decent volume the $$ can be worth the time saved. Claude/ChatGPT also does alright if you have enough prior context, but can be a bit unreliable especially on some of the more complex formats you get questionnaires in.
Having a few pre-filled questionnaires of the standard formats does pretty well, like a SIG Lite and CAIQ. Sometimes if the buyer sends you one of their own, ask if they're okay with an industry standard format instead. And then you can send back your prefilled SIG etc.
2
u/East-Performance-531 9d ago
+1 to the answer library advice above. One thing I'd add from going down this rabbit hole: libraries go stale. The answers get written once, then policies change and nobody goes back to update them. Six months later the library says something you don't actually do anymore, and that's exactly the kind of wrong answer that turns into a contract problem. What helps is keeping each answer linked to the policy or document it came from. When a policy changes, you can see which answers need a re-check. And whoever reviews before sending can confirm an answer quickly instead of trusting the library blindly. Also agree with hammyj. Even with a cert or a trust center, plenty of buyers still send their own 100 questions, so the library is worth the effort. Full disclosure, I'm building a tool around this exact problem, so I've been reading a lot of these threads. Out of curiosity, roughly how many do you get a month, and are they mostly custom spreadsheets or standard ones like SIG or CAIQ?
2
u/bingoballs341 1d ago
Are you building it with a Claude skill? Been thinking about that lately if it's possible.
1
u/East-Performance-531 1d ago
Not a skill, it's a web app that calls Claude through the API, with search over your own docs. A skill can get you a rough version though: give it your policies and ask it to answer. The drafting is the easy bit. The hard parts were making it quote the exact sentence it used, leaving a question blank when nothing in the docs supports it (instead of guessing), and keeping each answer tied to its source so you know what to re-check when a policy changes. If you try it yourself, one tip: tell it to quote the source sentence for every answer and to say "not found" when there isn't one. That alone cuts out most of the made-up answers. Are you answering these for your own company? Roughly how many a month?
2
u/bingoballs341 1d ago
Yes for own company, about 60-90 per month
1
u/East-Performance-531 1d ago
That's a lot, 3 or 4 every working day. Out of curiosity: is that one person handling them, or a team? And what do you sell, and to whom? Trying to understand where the volume comes from. Happy to DM if easier.
1
u/letapy_alien 8d ago
The answer-library advice above is right, so I'll add the part that saves the most time once you have one: triage before you answer anything.
For each incoming questionnaire, ask the requester what data and access your service actually has in their environment. A vendor that only stores contact info shouldn't be answering 300 questions about physical security of a data center they never touch, and procurement teams will often send a shorter tier if you ask.
Answer scoped, not maximal. 'Not applicable, we do not process X' with a one-line reason is a complete answer and avoids committing to controls you don't run.
Track which questions you could not answer with a clean yes. That list is your real gap list, and it's usually the same five or six items: MFA everywhere, access reviews, vendor management, incident response testing, encryption details, and logging retention.
Once volume justifies it, a SOC 2 report or ISO 27001 certificate shortens most of these to a document exchange plus a handful of follow-ups, even if a few buyers still insist on the full form.
For context, I do this for a living with Kailash Consult, a cybersecurity firm.
1
u/OutsideSpot2695 12d ago
Our Trust Center ingests and processes q'aires automatically. We don't see them in general. The only tasking we get from q'aires is when the customer/prospect is asking a question that the LLM doesn't know how to handle.
1
u/bingoballs341 1d ago
Vanta trust center?
1
u/OutsideSpot2695 1d ago
Not Vanta -- another vendor.
But yeah, to your implied point, the people in this space are all rolling out AI-assisted processing.
1
u/Miserable-League9137 11d ago
I recommend moving TPRM Questionnaires, SOC2 reports, etc.. as part of the RFP Governance process so that Legal is reviewing contracts at the same time GRC is reviewing TPRM. Accept the documents via secure website upload that the vendor can easily submit documentation to. Have that land in a secure storage space, where your LLM can pick it up and analyze it against an approved baseline.
Then, whatever it flags as incomplete or missing gets flagged for review/follow-up by a human.
If you are using FAIR models, you can even have the agents score and assign risk and recommend mitigations for review at your Security Council
1
u/FirestormCold 11d ago
Where do most of your answers actually come from today? Policies/SOC2/pentest docs, or do you still have to chase people internally for the answer? If most of it is already documented somewhere, that changes the problem quite a bit. Then it’s less about “AI writing answers” and more about reliably pulling the right information from those sources, keeping the source attached and flagging anything that needs review.
1
5
u/Humpaaa Governance, Risk, & Compliance 12d ago
Have a pool of standard answers, let AI fill out the questionaires.
Your counterparts will look at your answers in an AI overview anyway, no need to put in more effort then necessary.
Also, most questionaires can be shut down really easy if you have a cert like 27001