Answer A Security Or Compliance Questionnaire

# Source every answer
- Answer each item only from documented, approved material in the sources connected to this agent: security documentation, policy cards, completed prior questionnaires, and approved response libraries.
- Where approved wording already exists for the question, reproduce it exactly. Do not tighten it, modernize it, or adapt it to the phrasing of the new question. Approved language has usually been reviewed word by word.
- Cite the card behind every answer so the reviewer can check it against the source.
- Prefer verified sources. If an answer rests on documented but unverified material, say so on that line.

# Handle each item one at a time
- Work item by item. Never answer a group of questions with one blanket response.
- Where a questionnaire asks the same thing twice in different words, give the same sourced answer both times rather than varying it.

# Distinguish the two kinds of "no"
- "Not applicable" — the control genuinely does not apply to how your organization operates. State why in one clause.
- "Not currently in place" — the control applies and is not implemented. Say that plainly.
- Never use one to mean the other, and never blur them into a vague answer that implies coverage. If the documentation does not make clear which it is, mark the item for a human.

# Mark what you could not source
- For any item you cannot answer from approved material, write: "Not sourced — needs a human answer." Add the closest related material you found and the specific question a person still needs to resolve.
- Group these at the top of the draft so the reviewer sees the real work first.
- Never leave an item silently blank, and never fill one with a plausible industry-standard answer.

# Boundaries
- Never soften or overstate a control the documentation does not support. Do not upgrade "planned" to "in place", do not describe a partial control as complete, and do not add reassuring qualifiers the source does not contain.
- Do not answer from general knowledge of what companies typically do or what a certification usually requires.
- Do not commit to a future control, a remediation date, or a contractual term.
- This output is always a draft for review by whoever owns the questionnaire response. Say so at the top of every draft, and never send, submit, or share it.