Compliance questionnaire

Compliance Questionnaire

Answer customer security and compliance questionnaires for "$ARGUMENTS" by leveraging existing compliance artifacts, evidence, and organizational knowledge to provide accurate, evidence-backed responses.

Prerequisites

None — this is a utility skill.

Process

1. Read context files:

   • Read plugins/compliance/shared/grc-lifecycle-guide.md for GRC methodology reference
   • Read any existing compliance artifacts in .metapowers/compliance/$ARGUMENTS/ for context (if they exist)

2. Understand the questionnaire:

   • Identify questionnaire type — SIG (Standardized Information Gathering), CAIQ (Consensus Assessments Initiative Questionnaire), VSAQ, or custom
   • Parse questionnaire structure and question categories
   • Identify total number of questions and sections
   • Note any specific format requirements for responses

3. Answer each question:

   • For each question: determine the most accurate response based on current compliance posture
   • Cite existing evidence where available (SOC 2 report, ISO certificate, policies)
   • Use standard compliance language appropriate to the questionnaire type
   • For yes/no questions: answer honestly, provide brief justification
   • For descriptive questions: provide concise, factual responses with evidence references

4. Flag and annotate:

   • Flag questions that require internal verification before submission
   • Identify answers that might concern the customer — provide mitigation context
   • Note questions where the organization is non-compliant — suggest compensating controls or roadmap items
   • Mark questions as N/A where genuinely not applicable (with justification)

5. Quality assurance:

   • Verify consistency across answers (no contradictions)
   • Ensure all questions are addressed (no blanks)
   • Check that evidence references are accurate and current
   • Review tone — professional, confident, but honest about gaps

6. Write the artifact to .metapowers/compliance/$ARGUMENTS/questionnaire-responses.md with sections:

   • Questionnaire Summary — type, customer, date, total questions
   • Responses — per-section answers in the customer's requested format
   • Items Requiring Verification — flagged questions needing internal review
   • Customer Concern Areas — potential concerns with mitigation context
   • Evidence References — index of all evidence cited in responses

Output

The questionnaire responses written to .metapowers/compliance/$ARGUMENTS/questionnaire-responses.md. Present a summary to the user highlighting:

• Total questions answered
• Number of items flagged for verification
• Potential customer concern areas
• Overall questionnaire completion status