Any company that sells to larger organizations eventually spends days answering security questionnaires and RFP sections that are 80% the same as last time. The answers exist — in policies, past responses, architecture documents and compliance reports — but finding them, adapting them to a new format and getting them reviewed consumes senior people at the worst moment, when a deal is waiting.
What a grounded drafting system does
It reads the incoming questionnaire, retrieves the relevant passages from your approved source material, and drafts an answer with a citation to where it came from. Questions it can't support from the sources are flagged as gaps for an expert instead of filled with plausible text. The human reviewer starts from a cited draft and a short list of real gaps.
The rules that make it trustworthy
- One source of truth — a maintained library of approved policies and prior answers. The system is only as good, and only as current, as this library.
- Citations on every answer — the reviewer can check the claim against the original in seconds. An uncited answer isn't acceptable in a compliance context.
- Say 'we don't know' — if a control isn't documented, the right output is a gap, not an optimistic guess. Overclaiming a security control in a signed response is a serious problem.
- Human approval before anything leaves — drafts go to the owner of each domain (security, legal, engineering). The system never submits.
- Freshness checks — answers tied to documents with review dates, so a response built on an out-of-date policy is flagged before it goes out.
The measure of a good system here isn't how many answers it fills in. It's how reliably it separates 'supported by our documents' from 'needs an expert' — because that line is what protects you.
What to measure
- Turnaround time — receipt of the questionnaire to submission.
- Reviewer edit rate — how often experts change a drafted answer, and why. High edit rates on a topic usually mean the source material is thin there.
- Gap rate — the share of questions the sources can't answer, which is a roadmap for documentation you should write.
A good first step
Load your last five completed questionnaires and your current policies, then run the next incoming one through the system alongside the existing process. Compare time and accuracy honestly. If the drafts hold up, the saving is real, and the documentation gaps you uncover are a useful by-product.