Security and Vendor Questionnaire Answers

Upload the security or vendor due diligence questionnaire and offboarding policies, completed tickets, and access records. Word, Excel, PowerPoint and PDF files all work.

Review the stated control and the recorded actions, with missing evidence clearly highlighted. The questionnaire comes back in its original format.

Yes. Each answer shows its source documents, and yellow highlights mark details your files do not cover.

It is the questionnaire a customer sends a supplier to assess security, privacy, resilience and compliance risk before or during a contract. It asks which controls you have and, increasingly, for evidence that they operate. XiCLOPS drafts your answers from the policies, tickets and records you upload, and highlights where that evidence is still missing.

The SIG, the Standardized Information Gathering questionnaire from Shared Assessments, is usually completed in Excel. XiCLOPS answers questionnaires uploaded as Word, Excel, PowerPoint or PDF files, so a SIG Lite or SIG Core is uploaded like any other questionnaire. Questions in sections scoped out of the review can be unchecked before the run, so only the questions you select are answered.

Reviewers increasingly want proof that a control operates, not just a policy saying it exists. Typical evidence includes access review records, completed offboarding tickets, vulnerability scan summaries, incident response tests, training completion records and independent audit reports such as a SOC 2 report. Upload the evidence you can share, and the draft separates the stated control from the recorded actions.

Pair the offboarding policy, which sets the deadline and scope for removing access, with completed leaver tickets or access logs that show when each account was disabled. The example on this page does this: the ticket shows single sign-on removed within the policy deadline but has no VPN revocation timestamp, so that gap is highlighted.

Questionnaires often ask how often user access is reviewed and by whom. The access control policy sets the frequency and the reviewer, while completed review records, sign-offs or tickets show that each review took place. Upload both, and the draft answers from the policy and the records and highlights the evidence your files do not include.

A SOC 2 Type II report describes your controls and an independent auditor’s testing of whether they operated over a period. Many questionnaire answers can draw on it, though reviewers still check its scope, the period covered and any exceptions. Upload your own report with your policies, and anything it does not cover is highlighted in the draft.

It can draft the policy side, such as who approves access and how often reviews run. Questions that ask whether a control actually operated need records, such as tickets, review logs or audit results. When only the policy is uploaded, XiCLOPS answers the documented procedure and highlights the operating evidence still missing.

The CAIQ, from the Cloud Security Alliance, focuses on cloud security controls. The SIG, from Shared Assessments, covers a broad range of third-party risk areas. Many customers send their own questionnaire instead, often adapted from one of these. The underlying evidence is much the same, so one set of policies and records usually supports all three.

The draft answers the part your files support, then states what is missing in its own sentence, highlighted in yellow. For example, a ticket may show one system’s access removed but not another’s. That keeps a partial control from reading like a complete one and tells your team exactly what to collect.

Customer data is encrypted using AES-256 at rest and TLS 1.2 or higher for network communications. Access is limited through role-based and least-privilege controls, with MFA required for internal systems, production environments and administrative tools, and customer documents are not used to train underlying AI models. The Trust Center describes these controls in more detail.

Yes. Edit any answer yourself, or regenerate it with the documents and instructions you choose, for example to answer from the current access control policy only. Review the generated answers before using or sharing the questionnaire, particularly any that describe controls or evidence, since the customer may rely on them in its vendor risk assessment.

Security questionnaires can be long, so the question count often decides. Each paid run covers up to 100 questions and 1,500 source pages, and crossing either limit moves the job into another run. The run count is shown before you commit.

Reviewers ask whether you have an incident response plan, who runs it, how quickly customers are notified of a breach and when the plan was last tested. The plan answers the procedure questions, while tabletop exercise reports or post-incident reviews show it in use. Upload both, and a missing notification timeframe or test date is highlighted as a gap.

Customers want to know which third parties process their data on your behalf, where they are located, what they do and how you assess them. A subprocessor list, your data processing agreement and your vendor management policy usually answer this. If your files list the subprocessors but show no assessment of them, the draft states what is documented and highlights the missing review evidence.

Questionnaires ask for recovery time and recovery point objectives, backup frequency, failover arrangements and when the plan was last tested. Your business continuity and disaster recovery plans state the targets, while test results show whether they were met. If your files give targets without a recent test, the draft answers from the documented targets and highlights the missing test evidence.

Most ask how data is encrypted at rest and in transit, which algorithms and protocol versions are used, who manages the keys and how often they rotate. Your encryption or key management policy usually answers the standards, while configuration records or audit reports show them applied. Where your files state a standard but say nothing about key management, that part is highlighted for your security team.

Customers ask how often you scan for vulnerabilities, how quickly critical findings are fixed, whether an independent firm tests your application and whether its findings were closed. The vulnerability management policy sets the schedule and fix deadlines, while scan summaries and penetration test reports show results. If your files lack a recent test date or remediation record, the draft highlights it.

Yes. The free trial includes 1 run on your own documents, with no card required.