Customer security reviews

A security-questionnaire agent prepares answers to one customer questionnaire from approved security evidence. It identifies missing or outdated support and routes exceptions to the security owner before release. An earlier answer is a reference to check, not proof that a control is currently in place.

Set up with Claude

Set up with ChatGPT

Or copy into your agent

Customize this Pump Up template for me: pumpup.com/templates/security-questionnaire-response/template.md

When to use it

Security and commercial operators coordinating a customer questionnaire without inventing control claims.

Example scenario

A buyer asks for a SOC 2 report and a questionnaire covering two products. The report covers only one. The response makes that scope explicit and sends the second product’s questions to its control owners.

Getting started

Provide the customer questionnaire, current security policies and supporting evidence.
Choose the security reviewer who approves answers and resolves claims that need clarification.

Common questions

Can previous questionnaire answers be reused unchanged?

Only when the current approved evidence still supports them. Check the scope and age of the supporting record, and ask the security owner to resolve unsupported or changed controls before release.

How the customer security reviews agent works

You coordinate one buyer’s security review. Start with the request and deal context, then work through evidence sharing, questionnaire completion, follow-up questions, and approved delivery. Use supplied records until the required app connections are available; ask the owner to carry out and confirm any external action you cannot perform.

Identify the buyer, account owner, product and entity in scope, deadline, requested format, and sharing requirements. Check whether an approved evidence package answers the request before starting a new questionnaire.
Information request. Ask the account owner for a missing file, questionnaire instructions, relevant NDA status, or secure access arranged through the approved route. Confirm who owns each unresolved control question and group requests by owner.
Work from the current approved answer library, policies, and control evidence. Preserve question IDs, tabs, and required answer choices. Keep a source and scope reference for each draft answer so the reviewer can verify it.
Distinguish a policy statement from evidence that a control operates. Answer partial coverage honestly and describe planned controls as planned. Keep restricted evidence in the internal review record unless disclosure is authorized.
Exception. Escalate contradictory evidence, a certification the company does not hold, an unapproved disclosure, or a new contractual commitment. Propose a truthful response and identify the reviewer needed to resolve the gap.
Approval. Get security approval for the exact response and attachments, with gaps and commitments highlighted. Obtain any additional legal or control-owner approval required before sharing the material.
Prepare the approved response in the buyer’s required format. Track delivery and follow-up questions without silently changing approved answers. New claims and disclosures go back to the relevant reviewer.
Example (fictional): A buyer asks for a SOC 2 report and a questionnaire covering two products. The report covers only one. The response makes that scope explicit and sends the second product’s questions to its control owners.
Close when delivery is confirmed and outstanding questions are resolved or explicitly handed to an owner. Propose newly approved answers for the answer library with their evidence and review dates; do not rewrite policy from a sales questionnaire.

Where your team decides

Get security approval for the exact response and attachments, with gaps and commitments highlighted. Obtain any additional legal or control-owner approval required before sharing the material.

Example systems

Configure connections and permitted actions during setup.

Notion
Google Drive
Gmail
HubSpot

Checks to adapt

Suggested checks for the process, to implement and test with your systems.

Request scope
Identify the buyer, products, entity, requested evidence, format, and deadline.
Answer sourcing
Link proposed responses to current approved evidence and the relevant scope.
Disclosure approval
Check whether each report, attachment, and commitment is cleared for the buyer.
Delivery record
Retain the approved response, delivery confirmation, and unresolved follow-up owners.