vendor-security-questionnaire

name	vendor-security-questionnaire
description	Automated vendor security assessment through questionnaire generation, response parsing, and risk scoring
allowed-tools	["Bash","Read","Write","Glob","Grep","WebFetch"]
graph	{"domains":["domain:security"],"specializations":["specialization:security-compliance"],"skillAreas":["skill-area:compliance-automation","skill-area:vulnerability-management"],"roles":["role:compliance-officer","role:security-engineer"],"workflows":["workflow:compliance-audit"]}

Vendor Security Questionnaire Skill

Purpose

Automate vendor security assessment through standardized questionnaire generation, response parsing, security posture scoring, and risk report generation for third-party risk management programs.

Capabilities

Questionnaire Generation

• Generate industry-standard security questionnaires
• Create SIG (Standardized Information Gathering) questionnaires
• Build CAIQ (Consensus Assessment Initiative Questionnaire) forms
• Generate custom questionnaires based on risk tier
• Create vendor-type-specific assessments
• Support multiple response formats

Response Parsing and Analysis

• Parse questionnaire responses from various formats
• Extract key security control information
• Identify missing or incomplete responses
• Flag concerning answers for review
• Compare responses against requirements
• Validate evidence attachments

Security Posture Scoring

• Calculate vendor security scores
• Weight scores by control importance
• Compare against industry benchmarks
• Track score trends over time
• Generate risk-adjusted ratings
• Identify score improvement areas

Assessment Status Tracking

• Track assessment workflow status
• Monitor response deadlines
• Send automated reminders
• Escalate overdue assessments
• Maintain assessment history
• Archive completed assessments

Risk Report Generation

• Generate executive risk summaries
• Create detailed technical reports
• Produce comparison reports
• Build risk heat maps
• Generate board-level dashboards
• Export data for GRC systems

Vendor Compliance Monitoring

• Track vendor compliance commitments
• Monitor remediation progress
• Verify evidence of compliance
• Alert on compliance drift
• Schedule periodic reassessments
• Maintain compliance documentation

Questionnaire Standards

Standard	Use Case	Questions
SIG Lite	Low-risk vendors	~100
SIG Core	Medium-risk vendors	~300
SIG Full	High-risk vendors	~800+
CAIQ	Cloud providers	~300
VSAQ	General vendors	Variable
Custom	Specific needs	Variable

Assessment Domains

• Information Security Management
• Access Control
• Data Protection
• Network Security
• Application Security
• Physical Security
• Business Continuity
• Incident Response
• Compliance and Legal
• Third-Party Management

Integrations

• OneTrust: Third-party risk management
• ProcessUnity: Vendor risk management
• SecurityScorecard: Security ratings
• BitSight: Security ratings and benchmarks
• Prevalent: Third-party risk intelligence
• Shared Assessments: SIG questionnaire tools

Target Processes

• Third-Party Vendor Security Assessment
• Vendor Onboarding Security Review
• Annual Vendor Reassessment
• Vendor Risk Management

Input Schema

{
  "type": "object",
  "properties": {
    "operation": {
      "type": "string",
      "enum": ["generate", "parse", "score", "report", "track"],
      "description": "Questionnaire operation type"
    },
    "vendorInfo": {
      "type": "object",
      "properties": {
        "vendorName": { "type": "string" },
        "vendorId": { "type": "string" 
            
                 
                 
      
    
     
       
            
       
    
     
       
          
       
    
     
       
       
    
     
       
       
            
            
            
      
    
     
       
       
       
    
  
   

Output Schema

{
  "type": "object",
  "properties": {
    "assessmentId": {
      "type": "string"
    },
    "operation": {
      "type": "string"
    },
    "timestamp": {
      "type": "string",
      "format": "date-time"
    },
    "vendorInfo": {
      "type": "object"
    },
    "questionnaire": {
      "type": "object",
      "properties": {
        "type": { "type"  
            
            
            
      
    
     
       
       
            
            
            
            
            
      
    
     
       
       
            
                 
         
           
           
             
             
                  
                  
                  
            
          
        
            
            
      
    
     
       
       
         
         
              
              
              
              
              
        
      
    
     
       
       
            
            
            
            
      
    
     
       
          
    
     
       
    
  

Usage Example

skill: {
  name: 'vendor-security-questionnaire',
  context: {
    operation: 'generate',
    vendorInfo: {
      vendorName: 'Cloud SaaS Provider',
      riskTier: 'high',
      dataAccess: ['PII', 'financial']
    },
    questionnaireType: 'SIG-Core',
    deadline: '2024-03-15'
  }
}