Security Questionnaire Vendor DDQ

A prospect, customer, or partner sends a security DDQ and expects the MSP (or a client) to
attest to controls. The failure mode is confident wrong answers — every DDQ answer is an
attestation that can be held against you contractually. Draft from documented evidence, cite
sources, and mark anything unproven for human sign-off. Use this specifically for inbound
vendor/DDQ attestations answered from your own documented posture. Work it in order:

1. Establish whose posture is being attested — the MSP's own, or a specific client's. Answers
   must draw only from that entity's documented controls; do not blend the MSP's posture into
   a client's answer or vice versa.
2. Inventory the source evidence: existing policy docs, prior completed questionnaires, SOC 2
   report, the documentation platforms (IT Glue and Hudu), KB articles, and ticket/change
   history. This documented evidence is the ONLY basis for an answer.
3. Answer each question from evidence, and cite it: for every answer, record the source that
   backs it (policy name, SOC 2 control reference, documentation record). An answer with no
   citable source is not an answer yet.
4. Flag unknowns honestly — do not guess: where evidence is missing, ambiguous, or
   contradicts the question, mark the item "needs human review" with a note on what's
   missing, rather than asserting a control that may not exist.
5. Separate "yes," "no," "partial/compensating control," and "not applicable" precisely —
   DDQs punish vague affirmatives. A partial control is described as partial with its
   compensating measure, not rounded up to "yes."
6. Route the draft for human sign-off: the completed draft, with citations and flagged gaps
   clearly marked, goes to the accountable owner (MSP security lead or the client) for review
   and final attestation. You draft; a human attests.
7. Document what was produced: which questionnaire, whose posture, the evidence used, and the
   list of flagged items awaiting human input. Do not submit the questionnaire — submission
   is the owner's act.

Guardrails — always:
- Documented facts only — never invent a control, certification, or capability. No
  fabrication of policy names, dates, or SOC/audit references.
- Every answer carries a citation; every unknown is flagged for human review. "We don't
  currently document this" is an honest answer; a guessed "yes" is a misrepresentation.
- A DDQ answer is a binding attestation — you draft, a human owner reviews and submits. Never
  submit or send the questionnaire on the owner's behalf.
- Keep the MSP's posture and each client's posture strictly separate.
- Don't overstate partial controls — "partial with compensating control" is not "yes."
- Sanitized and confidential: don't expose one client's specifics inside another's
  questionnaire; no credentials or environment identifiers in answers. Plain text only for
  PSA-synced notes.
- When in doubt, flag for human review.