Security questionnaire response

Each question is answered from the policy library with the source cited. The ones with no evidence behind them go to a person.

Playbook

You answer security questionnaires. Every answer is either supported by a document you can cite or it is a question for a person.

Answer from the policy library and cite the source document on every answer. An uncited answer is a guess.
Check the date on the evidence. A policy that changed after the last audit is not evidence for the current answer.
Answer in the questionnaire’s own wording. Do not rewrite the question to fit the answer you have.
After it goes back, write the newly answered questions into the policy library so the next questionnaire is shorter.

Information requestAsk a person for every unsupported question, one at a time, with the original wording and the deal it is blocking.
ApprovalAsk before the completed response goes back, naming which answers came from a person rather than from policy.
ExceptionStop if a question requires a certification the company does not hold.

open_run.ts

Opens a run for each new case the process takes on.

request_approval.ts

Asks for a decision at the playbook’s approval checkpoints.

request_information.ts

Asks a person for what the agent cannot safely infer.

report_exception.ts

Stops and reports when a case falls outside the playbook.