Compliance Compliance Questionnaire

---
name: compliance-compliance-questionnaire
description: Answer a customer security or compliance questionnaire (SIG, CAIQ, VSAQ or custom) from existing compliance artifacts, flagging answers that need verification or may worry the customer. Use when a prospect or customer sends a security questionnaire or vendor assessment and the user needs it filled in.
metadata:
  argument-hint: "[project] [--skip-checks]"
---

# Compliance Questionnaire

Answer customer security and compliance questionnaires for "$ARGUMENTS" by leveraging existing compliance artifacts, evidence, and organizational knowledge to provide accurate, evidence-backed responses.

**Arguments.** `$ARGUMENTS` may contain the project name and optional flags. Take the first token as `<project>` and treat `--skip-checks` as a flag; never include flags in file paths. All paths below use `<project>`. If `--skip-checks` is present, skip the prerequisite check and, **before writing any artifact**, append one line to `.singularskills/log.jsonl`: `{"ts":"<ISO timestamp>","skill":"compliance-compliance-questionnaire","workflow":"compliance","phase":null,"project":"<project>","event":"skipped","artifact":"<artifact file>","note":"<reason or \"none given\">"}`.

## Prerequisites

None — this is a utility skill.

## Process

1. **Read context files:**
   - Read `references/grc-lifecycle-guide.md` for GRC methodology reference
   - Read any existing compliance artifacts in `.singularskills/compliance/<project>/` for context (if they exist)

2. **Understand the questionnaire:**
   - Identify questionnaire type — SIG (Standardized Information Gathering), CAIQ (Consensus Assessments Initiative Questionnaire), VSAQ, or custom
   - Parse questionnaire structure and question categories
   - Identify total number of questions and sections
   - Note any specific format requirements for responses

3. **Answer each question:**
   - For each question: determine the most accurate response based on current compliance posture
   - Cite existing evidence where available (SOC 2 report, ISO certificate, policies)
   - Use standard compliance language appropriate to the questionnaire type
   - For yes/no questions: answer honestly, provide brief justification
   - For descriptive questions: provide concise, factual responses with evidence references

4. **Flag and annotate:**
   - Flag questions that require internal verification before submission
   - Identify answers that might concern the customer — provide mitigation context
   - Note questions where the organization is non-compliant — suggest compensating controls or roadmap items
   - Mark questions as N/A where genuinely not applicable (with justification)

5. **Quality assurance:**
   - Verify consistency across answers (no contradictions)
   - Ensure all questions are addressed (no blanks)
   - Check that evidence references are accurate and current
   - Review tone — professional, confident, but honest about gaps

6. **Write the artifact** to `.singularskills/compliance/<project>/questionnaire-responses.md` with sections:
   - **Questionnaire Summary** — type, customer, date, total questions
   - **Responses** — per-section answers in the customer's requested format
   - **Items Requiring Verification** — flagged questions needing internal review
   - **Customer Concern Areas** — potential concerns with mitigation context
   - **Evidence References** — index of all evidence cited in responses

## Output

The questionnaire responses written to `.singularskills/compliance/<project>/questionnaire-responses.md`. Present a summary to the user highlighting:
- Total questions answered
- Number of items flagged for verification
- Potential customer concern areas
- Overall questionnaire completion status

End the artifact with this paragraph, verbatim:

> **Not legal or audit advice.** This artifact supports preparation for compliance work; certification, attestation and regulatory conclusions require a qualified auditor or counsel.