Answer a security questionnaire without saying yes to everything
A customer, an insurer or a bank sends a long security questionnaire and a deadline. QoBot drafts the answers from your evidence, asks you only what it can't know, and turns every gap into a dated action.
Northwind Logistics' answers to the retailer's questionnaire are drafted: 187 of 212 from your files, 14 need a fact from you, 11 are honest gaps with a date. Before Friday:
- Priya (operations): confirm when a backup was last restored · ~10 minYour turn
- Sam (IT provider): send the MFA report for the admin accounts · request drafted · ~15 minYour turn
- You: approve the answers and the note on the 24-hour notification clause · ~20 minNeeds you
Answering a questionnaire: who does what
What QoBot does
- Reads the file in its format (XLSX, DOCX, PDF) and sorts the questions by theme.
- Answers from your workspace and reuses your earlier answers, checked against today.
- Asks the missing facts one topic at a time, in plain words, and drafts the question for your IT provider.
- Flags the clauses that commit you, like a 24-hour incident notice.
- Turns every gap into an action with an owner and a date.
What your team does
- Confirm the facts only you know: tools, people, what was really done.
- Approve the wording of each gap and each commitment.
- Send the answers yourself, with the attachments you choose.
Why it lands on your desk
Customers check their suppliers. A retailer, a bank, a hospital or a carmaker sends a supplier security questionnaire, sometimes a few dozen questions, often a few hundred, with a deadline that doesn’t move. Organisations in scope of NIS2 must manage the security of their supply chain, and GDPR asks them to choose processors that offer sufficient guarantees, so these questionnaires keep coming.
Most of the questions repeat from one customer to the next: MFA, backups, devices, email, suppliers, incidents, policies. The work is finding the evidence, wording the answer, and being honest about what isn’t done yet.
How QoBot answers
- Reads the questionnaire in its original format and gives you a three-line summary: who’s asking, how many questions, the deadline.
- Sorts the questions by theme and reuses your earlier answers, checked against what’s true today.
- Drafts each answer from your workspace. Every answer rests on a document, on a statement from you (recorded with who and when), or it’s declared a gap.
- Asks what’s missing, one topic at a time, in plain words. When you don’t know, it drafts the question for your IT provider.
- Flags commitments. “Notify us of any incident within 24 hours” is a clause, not a question. QoBot says what it commits you to and whether you can keep it today.
- Turns gaps into actions with an owner and a date, and marks the quick wins you could finish before the deadline.
- Writes the answers back into the file, after your approval. You send it.
The one rule: no “yes” without a basis
| Situation | Answer |
|---|---|
| A report shows MFA on all 27 accounts | Yes. Enforced for all 27 accounts (report available on request). |
| MFA on 4 of 27 accounts | Partially: enforced for administrator accounts (4 of 27). Extension to all users planned by 30 November 2026. |
| “I think our provider did it” | Under verification; we will confirm by the date you set. |
| Not in place, nothing planned | No. This control is not in place today. |
An honest gap with a date reads better than a vague yes, and it gives you a plan. The next questionnaire then starts from stronger answers.
What stays with you
You know your company. You confirm facts, decide the wording within the honesty rules, and send. QoBot keeps a library of your answers so the next questionnaire goes faster.
FAQ
Can I just answer yes to everything?
No. A false yes can cost you the customer at the first audit, breach a contract, or put an insurance claim at risk. An honest “not yet, planned by March” rarely loses a deal. QoBot never writes “yes” without a file or a statement from you behind it.
Which formats does QoBot handle?
Spreadsheets, Word documents and PDFs. QoBot answers in the questionnaire's language and gives you back a file in the format you received, or an answer sheet when the original is a PDF.
Does our data leave the computer?
Your workspace stays on your computer. QoBot works through the AI provider you chose, under your own account. Attachments and evidence leave your machine only if you approve each one.
Is an insurer's form any different?
It's a declaration, so the honesty rule matters even more. See cyber insurance.
Sources
- Directive (EU) 2022/2555 (NIS2), article 21(2)(d)EUR-Lex · supply chain security: why in-scope customers question their suppliersOfficial text
- Regulation (EU) 2016/679 (GDPR), articles 28 and 32EUR-Lex · processors' guarantees and security of processingOfficial text
This page explains the rules in plain words. It isn't legal advice: for a borderline case, ask a lawyer. Report an error