Questionnaires

Automatically answer security questionnaires using your existing compliance data. zGovern's keyword-matching engine searches your controls and policies to suggest accurate, confident answers in seconds.

Overview

Security questionnaires (SIG, CAIQ, custom vendor assessments) are a significant time burden for security and compliance teams. A typical enterprise security questionnaire contains 200–500 questions that can take days to complete manually.

zGovern's auto-answer engine analyses each question and searches your:

• Active compliance framework controls and their plain-English descriptions
• Published (ACTIVE) policies and their content
• Control statuses (COMPLETE controls contribute higher confidence)

Each answer suggestion comes with a confidence score (0–100%) indicating how closely the source material matches the question.

Supported Formats

Importing a Questionnaire

zGovern accepts questionnaire questions as raw text. You can paste directly from a Word document, Excel export, or email thread.

1. Navigate to Questionnaires

   Click Questionnaires in the sidebar and then click New Questionnaire.

2. Enter questionnaire details

   Provide a title (e.g., "Acme Corp Security Review 2026") and optionally the name of the requesting company.

3. Paste the questions

   In the Questions text area, paste the raw question text. Each question should be on its own line or separated by a blank line. Numbering is optional — zGovern will parse it automatically.

   Example input format

   1. Do you enforce multi-factor authentication for all users?
   2. How frequently do you conduct penetration testing?
   3. Do you have a formal incident response plan?
   4. Are employee background checks performed prior to hiring?
   5. How is data encrypted in transit and at rest?

4. Save and run auto-answer

   Click Save, then click Auto-Answer. The engine will process all questions and return suggested answers within a few seconds.

Auto-Answer Engine

The auto-answer engine uses keyword matching to find relevant controls and policy content for each question. Here's how it works:

Keyword Matching

For each question, the engine:

1. Extracts meaningful keywords (nouns, security terms, compliance concepts)
2. Strips common stop words (the, is, do, you, etc.)
3. Searches all controls' plainEnglish fields and policies' content fields
4. Ranks matches by term frequency and control completion status
5. Returns the top 3 matching sources and synthesises a suggested answer

Confidence Scoring

Each suggested answer includes a confidence score from 0 to 100%:

{
  "success": true,
  "data": {
    "questionnaire": {
      "id": "clxq7m3np0001lg9a",
      "title": "Acme Corp Security Review 2026"
    },
    "answers": [
      {
        "questionIndex": 0,
        "question": "Do you enforce multi-factor authentication for all users?",
        "suggestedAnswer": "Yes. Multi-factor authentication (MFA) is mandatory for all user accounts accessing production systems, as defined in our Access Control Policy. MFA enforcement is monitored continuously via our Okta integration and verified quarterly.",
        "confidence": 94,
        "sources": ["CC6.1 - Logical Access Controls", "Access Control Policy v3"]
      },
      {
        "questionIndex": 1,
        "question": "How frequently do you conduct penetration testing?",
        "suggestedAnswer": "We conduct annual penetration testing by an independent third-party security firm. Results are reviewed by senior management and critical findings are remediated within 30 days.",
        "confidence": 71,
        "sources": ["CC7.1 - System Operations"]
      }
    ]
  }
}

Review and Edit Answers

After the auto-answer engine runs, you review each answer in the questionnaire editor:

• Each question shows the suggested answer, confidence score, and source controls/policies
• Click any answer to edit it directly in the text field
• Low-confidence answers are highlighted and sorted to the top for manual attention
• Mark questions as Reviewed once you've verified the answer
• Questions flagged Needs Review (low confidence) appear in a dedicated tab

Exporting Answers

Once all answers are reviewed, export the completed questionnaire as a .txt file:

====================================
ACME CORP SECURITY REVIEW 2026
Completed: 2026-03-08
Total Questions: 47 | Answered: 47
====================================

Q1: Do you enforce multi-factor authentication for all users?

A: Yes. Multi-factor authentication (MFA) is mandatory for all user accounts
accessing production systems, as defined in our Access Control Policy. MFA
enforcement is monitored continuously via our Okta integration and verified
quarterly. [Source: CC6.1, Access Control Policy v3]

----

Q2: How frequently do you conduct penetration testing?

A: We conduct annual penetration testing by an independent third-party
security firm. Results are reviewed by senior management and critical
findings are remediated within 30 days. [Source: CC7.1]