AI for RFP Responses in Technology: The Security Questionnaire Is the Hard Part

This is about the response desk inside a software or technology vendor selling into large enterprises: one or two people, in sales operations or security, who own everything a buyer sends in before they will sign. It is not about public sector bidding, and it is not about the sales narrative. The pitch is normally the easy part. The difficulty is the stack of questionnaires behind it, where a wrong answer is not a weak pitch. It is a statement about your controls that your own contract will hold you to.

What actually arrives

An enterprise evaluation rarely arrives as one document. There is a functional requirements matrix with mandatory and desirable rows and a comply column. A security questionnaire, either in a standard industry framework or in the buyer's own workbook with its own scoring scheme. A data protection assessment asking where personal data goes and who processes it. An accessibility conformance request. A resilience and exit questionnaire covering recovery objectives, concentration risk and how the buyer gets their data back if you fail as a company.

Each comes from a different team, on a different deadline, and nobody over there owns the set. The desk's real job is one consistent account of the same product for five audiences who do not talk to each other. Inconsistency between the documents is what triggers the call that costs two weeks.

The same control, asked eleven ways

Eleven buyers will ask about encryption at rest in eleven phrasings, at different levels of detail and in different answer formats. A library keyed to question text handles this badly: fuzzy matching on wording retrieves an answer that looks close but describes a neighbouring control, and when the control itself changes you cannot find every place you described it.

Key the library to the control instead. Each entry is one control with a named owner, a plain statement of what the control actually is, approved external wording at two or three levels of detail, the supporting evidence, and the date that evidence was last verified. Answering is then two steps: classify the question to a control, then render the approved wording in the format the questionnaire demands, as yes or no with a comment, a paragraph or a maturity rating. Agents are good at classification, which is what keyword search does worst.

Evidence that expires, and three states of a control

Every answer library decays the same way: the answer was true at the last audit and is not true today. The penetration test covers the previous version of the platform. A subprocessor was replaced. A region was added. The restore test is overdue. So treat expiry as a first class property of the library rather than an annual clean up. Each entry carries a review date and a reference to the artefact behind it, and an agent flags an answer as stale when it is drafted, rather than leaving it for the buyer's auditor to find.

Exists, documented, evidenced

Underneath that sit three distinct states. A control that exists, meaning your engineers genuinely do the thing. A control that is documented, meaning an approved policy says so. A control that is evidenced, meaning you can produce an artefact an outside assessor would accept, such as a log export or an audit report section.

The response desk is often where those gaps first become visible, because it is the first function that must assert all three in writing to an outsider. An agent that drafts answers should also maintain the register of which state each control is in. That register is usually worth more to the security leader than the drafts.

What you may share, and under what agreement

Certifications, audit reports and penetration test results have different distribution rules and are not interchangeable. A certificate is public. A full audit report normally travels only under an executed non disclosure agreement, to named recipients, sometimes through a portal that watermarks each copy. A full penetration test report usually should not leave the building, while a summary letter from the testing firm can.

The failure mode is someone attaching the wrong file to a reply. An agent can do the classification: for each artefact requested, what you hold, the sharing rule, whether an agreement is in place and whether it covers this entity. Release stays a human action with a name against it.

Subject matter experts should review, not author

The scarce resource is time from the security engineer, the platform lead and the privacy counsel. They are not slow. They were hired to do something else, and this work appears in nobody's objectives.

So design the loop so they review rather than author. The agent produces a complete draft for every question, showing which control it matched, the approved wording, the evidence reference and how confident it is. The expert is then asked something answerable in seconds: is this still accurate for this edition of the product. Route the review by control owner too, so each expert gets one coherent batch about their own area rather than the questionnaire in the buyer's order.

When the honest answer is partially

Some answers are neither yes nor no. The control exists for one deployment model. It is on the roadmap. It is covered by a compensating control.

These are the answers that do damage when improvised. A cheerful yes with a roadmap note, written at eleven at night to hit a deadline, commits an engineering team that has not agreed to it. Every partial answer needs what is in place today, the compensating control if there is one, and a roadmap statement approved by whoever owns the roadmap.

An agent should detect the partial case and decline to produce a confident yes. Keep standing approved language for known gaps, dated and reviewed like everything else, so the desk picks from approved options rather than inventing under pressure.

Scoping by edition and deployment model

The true answer often differs by tier. Single sign on is in one edition and not another. Customer managed keys exist only on the top plan. A single tenant deployment behaves differently on residency from the shared service. The self hosted version two releases back does not have the architecture you are describing.

So the library needs scope recorded on each entry, and the agent needs the product, edition, version and deployment model before it drafts anything. Without that, you will accurately describe a configuration the buyer is not purchasing. That is the hardest mistake to unwind, because every word of it was true.

The AI and data questions that now stall deals

The questions currently holding up software deals are about your own AI features. Is customer content used to train models. Which model providers are subprocessors. Where does inference run and can it be pinned to a region. Can the features be disabled per tenant. What does the provider retain, for how long, and is there human review.

These answers move for ordinary engineering reasons. Switching a model provider is a normal decision that nobody thinks to report to the response desk. Wire it together: the subprocessor list is the source of truth, every answer depending on it holds a reference, and a change to the list flags every affected answer for review. Otherwise your questionnaire answers and your published list drift apart, and buyers do compare them.

What you answer here ends up in the contract

A completed questionnaire is not marketing collateral. Enterprise buyers routinely attach it to the agreement, draft the security schedule from it, or lift a stated recovery time objective straight into a service level.

The desk therefore needs a clean handoff to legal: every commitment in the submitted pack that is forward looking, conditional or stronger than your standard terms. An agent can extract that list from the final documents. What legal does with it is contract review, which is a separate discipline covered elsewhere.

Publishing ahead of the question, and the reassessments nobody staffs

The cheapest questionnaire is the one that arrives smaller. A trust centre holding your certifications, the subprocessor list, residency options, the accessibility conformance report and a standard framework questionnaire completed in advance removes a good share of what buyers ask. Mature buyers accept published answers for routine controls and save their questions for what is specific to them.

Then there is the installed base: annual reassessments, renewal questionnaires and notification obligations when something material changes. Nobody staffs this, and it lands on the same desk working a live deal. Agents suit it well, because reassessment is largely a diff between this year's questions and last year's approved answers.

Where AI fails here

The serious risk is a confidently wrong control answer. Ask a language model whether you encrypt backups in a particular region and it will produce a fluent, plausible yes. Submitted, that is a misrepresentation with contractual consequences, and no amount of drafting speed pays for one. What holds is retrieval from an approved, owned library with explicit refusal when no approved answer exists, not free generation over your documentation. Refusal has to be designed in, and reviewers thanked for it rather than chased.

Models know what your documents say, not what your systems currently do. The distance between documented and actual is exactly what these questionnaires probe, so automation cannot close it and will sometimes hide it.

Buyer workbooks are hostile artefacts: merged cells, macros, conditional validation, dropdowns that must be selected rather than typed. Ingestion and return formatting are usually the ugliest part of the build, and that is engineering work, not prompt work.

Near miss classification is the error that survives review, because an answer about encryption in transit reads perfectly well against a question about encryption at rest. Show the matched control name beside the answer, so the reviewer checks the match rather than the prose. And no agent decides that an artefact may be released.

Cycle time to a reviewed answer, and rework

Measure two things: elapsed time from a questionnaire arriving to a response a named reviewer has approved, and the rework rate, meaning how many drafted answers come back changed and how many follow up rounds the buyer opens. Words generated measures nothing.

Start narrow. Take one questionnaire type, one product edition and the controls you are asked about most often. Build the control keyed library for those, with owners and expiry dates on every entry, and leave the rest on the current process until that set is trusted. If you want to talk through what that first slice looks like in your business, hello@adoptaipartners.com.