Security & Compliance · Agent workflow

Answer security questionnaires from evidence, with review built in

When a customer sends you a security questionnaire, ZeroTwo drafts each answer from the policies, tickets and prior answers you approve. Every answer names its source, version, owner and confidence, and anything unsupported or in conflict goes to a person before the packet is sent.

• Google Drive
• Jira and Confluence
• Slack

A questionnaire can run to hundreds of questions. Some answers live in an audit report, some in a Confluence page, some in Jira remediation tickets and some only in the head of the person who handled the last enterprise review. Sales wants speed. Security wants accuracy. Nobody wants to promise a control that does not exist.

Answer libraries help until they decay: wording changes, a subprocessor moves, a policy is revised and last quarter's answer stops being safe. So the useful workflow is not auto-filling a form. It is collecting evidence, drafting with sources, catching conflicts and routing the risky answers to a person.

Gate 1: each answer

Every drafted answer lands in one of three states, and the state decides how much review it gets.

• ReusedSame approved answer, and its source file and linked tickets are unchanged since approval. A quick look is enough.
• New or changedNo approved answer yet, or the evidence moved. The evidence owner approves, edits or rejects it.
• Unsupported or in conflictNo current evidence, or two sources disagree. The agent does not write a confident answer; it asks the owner.

Gate 2: the whole packet

Whatever the answer states, the assembled packet needs a named person to approve it before it goes back to the customer.

• Final approvalA security owner reads the finished packet, including the reused answers, and approves it as one document.
• SendingZeroTwo does not return the questionnaire or sign it. Your team sends it from your own channel.

How ZeroTwo prepares a response

It starts when a questionnaire is uploaded or forwarded to the folder you set up. It reads only what you approve.

Reusing an answer safely

A saved answer is reusable only while all of these hold. Otherwise it goes back to its owner.

• The source document is the same version, and its review date has not passed.
• The linked tickets have the same status they had when the answer was approved.
• The review-by date you set when saving the answer has not passed.

ZeroTwo's data handling is described in the privacy policy. When a regulation changes an answer, the compliance change monitor is the workflow that surfaces it. For customer escalations that start with a security finding, see the support escalation brief.

A starting prompt

Fill in the brackets. It asks for the sources, the owner and the disclosure class, and it stops short of sending.

A customer questionnaire is in [folder or attachment]. Answer it using only the approved evidence in [evidence folder] and the control status in [Jira project / Confluence space].

For each question return: the proposed answer, the source document with version and date, the evidence owner, a confidence note, and a disclosure class (shareable, NDA only, hold, do not disclose).

If evidence is missing, stale or contradicted by an open ticket, set the status to "needs owner", "conflict" or "no evidence" and do not write a confident answer. Quote both sources when they conflict.

Treat a previously approved answer as reusable only if its source version and linked tickets are unchanged and its review-by date has not passed.

Do not sign anything or send anything to the customer. Post the draft packet to [channel] for [security owner] to approve.