Use this for one questionnaire at a time. You get three files in a new folder, ./customer-security-questionnaire-answers/<customer-role-or-deal-id>/: a spreadsheet you can open in Excel with every question, a draft answer, the document it comes from, a confidence level and the owner who must confirm it (answers.csv); a list of answers that need a human decision, such as promises, sensitive details and contradictions (flags.md); and the new or corrected answers worth keeping for the next questionnaire (library-updates.md). This skill drafts for a human to review and sign; this skill never marks a control effective. Questionnaire answers often become part of the contract, so a named person approves every one before it leaves.

Inputs to gather

Read the questionnaire in whatever form it arrived, the company's policies and procedures, its assurance reports or certificates, past answered questionnaires if the company keeps an answer library, the architecture overview, the subprocessor list and the standard contract and data processing terms. Ask the reader, in one message: the deadline, the size and sector of the customer, whether the answers will be attached to the contract, who approves the final answers, and which documents may be shared under a confidentiality agreement.

Step 1: parse and group

One row per question: the customer's reference and wording unchanged, the type (yes or no, free text, document request, file upload), and a topic (access, encryption, incident, privacy, people, development, continuity, suppliers). Group duplicates; long questionnaires ask the same thing three ways, and the answers must match.

Step 2: draft each answer from a source

Answer from the company's documents and records only, and cite the path or section and the date of the source for each answer. Flag sources older than the customer will accept (a penetration test from last year, a certificate near expiry, a report outside the current period). Give each a confidence level:

Evidenced: a policy says it and a record or configuration shows it happens.
Policy only: written down, but no record at hand; owner to confirm.
No source: nothing found. Leave the answer blank and route it to an owner; never fill the gap with what companies usually do.

Write answers that are short, true and scoped: "Yes. Production access uses single sign-on with multi-factor authentication; see the access control policy, section on authentication." When the truth is partial, say so: "Yes for production systems; internal tools are being moved to single sign-on." Answer the question asked and do not volunteer architecture details the question did not request.