Vendor Questionnaire Responder — CAIQ, SIG & Security Assess

Step 1 — Answer Library

No answers/ directory or library file was provided. Treating this as a fresh library — all matches will be DOC_SUPPORTED, PARTIAL, GAP, or OUT_OF_SCOPE. Nothing is a LIBRARY_HIT.

Step 2 — Parsed Questionnaire

{
  "questionnaire_id": "apex-financial_meridian-saas_2026-09-15",
  "questions": [
    {"q_id": "BCP-01", "control_domain": "Business Continuity", "question_text": "What are the organization's defined Recovery Time Objective (RTO) and Recovery Point Objective (RPO)?", "response_type": "text"},
    {"q_id": "END-03", "control_domain": "Endpoint Security", "question_text": "Does the company technically enforce restrictions preventing the installation of unapproved software, hardware peripherals (e.g., USBs), and browser extensions?", "response_type": "yes_no"},
    {"q_id": "LEG-01", "control_domain": "Legal & Privacy", "question_text": "I hereby certify on behalf of my organization that we comply with all applicable local, state, and federal privacy laws regarding customer data.", "response_type": "yes_no_na"}
  ]
}

No parse errors. No prefilled cells present to verify.

Step 3 — Classification

Step 4 — Draft Answers

BCP-01: Doc 1 (Disaster Recovery Plan v1.0, 2024-01-15, §4) states one RTO/RPO; Doc 2 (Enterprise Resiliency Standard v3.2, 2026-02-10, §2.1) states a different, more current RTO/RPO for core production systems. Per guardrails, answering with the more recent/authoritative document while flagging the discrepancy.

END-03: The Acceptable Use Policy establishes a policy-level restriction (standard user privileges, prohibition on unapproved software) but does not describe a technical enforcement mechanism (e.g., endpoint allow-listing, USB port control, browser extension management). Answering "Yes" here would conflate policy with technical control — a guardrail violation. Drafted as partial with scope limit.

LEG-01: This is a first-person attestation ("I hereby certify... on behalf of my organization"). Per scope rules, this requires a human signature/formal certification and cannot be drafted on the organization's behalf.

Step 5 — Assembled Outputs

Completed Answer Table

Gap Report

Follow-up Question Handling

No follow-up branches (followups_if_yes) were present in the source questionnaire structure, so none apply.

Change Log

• BCP-01: Newly drafted (DOC_SUPPORTED with conflict) — awaiting approval.
• END-03: Newly drafted (PARTIAL) — awaiting approval; technical-enforcement gap flagged for owner.
• LEG-01: Marked HUMAN REQUIRED — not drafted, no library action.
• No stale library answers (library was empty prior to this run).

CSV Export## Step 6 — Library Update & Staleness Check

No prior library existed, so there's nothing to mark stale. Writing 2 new draft entries (BCP-01, END-03) to a fresh library; LEG-01 is not added since it's out-of-scope, not an answerable question.

Step 7 — Review Summary

## Review Summary
- Total questions/rows processed: 3
- Answered from approved library: 0
- Newly drafted (awaiting approval): 2 (BCP-01, END-03)
- Gaps requiring owner input: 1 partial (END-03 technical-enforcement portion) → see Gap Report
- Out-of-scope (human/legal): 1 (LEG-01)
- Parse errors (unrecoverable): 0
- Stale answers flagged: 0
- **Action required:** review and approve 2 draft answers; resolve the BCP-01 RTO/RPO document conflict; route LEG-01 to an authorized signatory; source technical-enforcement evidence for END-03 if it exists.

Note on END-03: I did not answer "Yes" here even though the policy language sounds close — enforced policy and enforced technically are different claims, and only the former is documented. Answering "Yes" would be the kind of assessor-facing overstatement the guardrails exist to prevent.

Q-ID,Domain,Question Text,Answer,Evidence / Comments
BCP-01,Business Continuity,"What are the organization's defined Recovery Time Objective (RTO) and Recovery Point Objective (RPO)?","Per the most current governing document, RTO is 4 hours and RPO is 1 hour for core production systems. Note: an older document specifies RTO 24h/RPO 12h -- see Gap Report for discrepancy.","(Source: Enterprise Resiliency Standard v3.2, Section 2.1, 2026-02-10) -- conflicts with Disaster Recovery Plan v1.0, Section 4, 2024-01-15"
END-03,Endpoint Security,"Does the company technically enforce restrictions preventing the installation of unapproved software, hardware peripherals (e.g., USBs), and browser extensions?","Partially supported. Policy prohibits unapproved software installation and restricts employees to standard privileges. No documentation confirms technical enforcement (e.g., device/USB control, browser extension management, allow-listing). NEEDS OWNER for the technical-enforcement portion.","(Source: Acceptable Use Policy v2.1, Section 5, 2025-08-01) -- policy-level only"
LEG-01,Legal & Privacy,"I hereby certify on behalf of my organization that we comply with all applicable local, state, and federal privacy laws regarding customer data.","HUMAN REQUIRED -- attestation on behalf of the organization; requires authorized signatory, not a drafted answer.","N/A"