Security Questionnaires

Security questionnaires — the 200-question spreadsheets vendors send to their prospects during procurement — are a recurring tax on compliance teams. Muin’s Questionnaires module reduces the tax by pre-filling answers from your existing compliance data (active frameworks, implemented controls, active policies) so you review instead of typing.

What the Module Does Today (Beta)

At beta, the module provides:

Upload + parse — accept a questionnaire in a supported format and parse its questions into Muin’s data model
Template-based pre-fill — for each question, match keywords to a compliance category, find relevant controls from your active frameworks, and fill in a template answer citing those controls
Review queue — human reviewer goes question-by-question, editing drafts, attaching additional sources, or writing answers for questions that didn’t match
Bulk approve — once a reviewer is happy with a batch of questions, bulk-approve them in one action
Export — generate a structured export of the completed questionnaire

Plain-English: What “Template-Based” Actually Means

The current answer generator (QuestionnaireService._generate_answer_for_question) does NOT call an LLM. It:

Lowercases the question text
Scans for keywords across eight compliance categories (access_control, encryption, incident_response, security, privacy, governance, vendor_management, operations)
Picks the first category whose keywords match
Finds controls in your active frameworks filed under that category
Assembles a templated sentence citing those controls by name

The confidence score is computed as min(0.85, 0.5 + n_controls × 0.05). So a question with zero matching controls scores 0.50; a question with 7+ matching controls caps at 0.85.

What This Means for You

The draft answer is a structural placeholder citing your real controls, not a ready-to-ship response
Every answer needs a human review pass before export — the template output works as a scaffolding, not a finished answer
Questions that don’t keyword-match any category get a generic “please contact our compliance team” boilerplate with confidence 0.50

Real LLM Autofill — Post-Beta (Plan 276)

A real LLM-powered autofill — using Bedrock Claude to draft actual prose answers grounded in your policies, evidence, and control implementation notes — is tracked in Plan 276 (post-beta). That work will:

Replace the template-sentence path with LLM-drafted prose
Add a citation fence so answers cite only real tenant evidence
Surface a source badge (LLM vs template-fallback) on each answer
Retain the review-and-approve workflow as the gate for export

Until that ships, the product you use today is honest-about-what-it-is: template pre-fill, not AI generation.

The Workflow

1. Upload a Questionnaire

On /compliance/questionnaires, click New Questionnaire. The upload form accepts:

Field	Purpose
Name	Friendly descriptor (often the requesting vendor’s name)
Description	Optional context for reviewers
Uploaded file	The source questionnaire

On upload, Muin parses the file into QuestionnaireQuestion rows linked to the parent QuestionnaireUpload. Parsed questions go through the lifecycle:

uploaded → extracted → generating → completed
                            ↓
                         failed (individual question errors tracked per-question)

2. Generate Draft Answers

Click Generate Answers on the questionnaire’s detail page. This runs the template-based pre-fill across every question. Implementation details:

Tenant knowledge context — a single-pass query pulls active frameworks, controls grouped by category, and active policies once at the start of the batch (no N+1 queries)
Per-question error isolation — a failure on one question doesn’t abort the batch; failed questions are logged and counted
Generation lock — an atomic UPDATE-with-predicate gates concurrent callers. Two admins clicking Generate simultaneously can’t both burn the work; the loser gets "Questionnaire is already generating answers. Please wait."
Stale-lock recovery — if a generation has been GENERATING for more than N minutes without completing, the next caller steals the lock and retries (so a crashed generation doesn’t wedge the questionnaire)

When generation completes, the questionnaire transitions to completed, answered_count is updated, and confidence_avg is the mean across drafted questions.

3. Reviewer Signoff (HumanTask Fanout)

On completion, generate_answers emits a HumanTask for reviewer signoff (category=QUESTIONNAIRE_REVIEW). The task points back to the questionnaire detail page. The compliance owner (or an assigned reviewer) works through each question — editing answer text, attaching additional sources, adjusting confidence, or marking for re-generation.

Re-generation is allowed — moving a question back to drafted status lets the reviewer click Generate again. The lock logic prevents concurrent re-generations.

4. Bulk Approve

On the review page, the Bulk Approve button approves all drafted questions in the current view at once. Useful when the template output is uniformly acceptable and you just need to advance the workflow without clicking each row. Bulk approve:

Transitions every selected question to approved
Records the approver, timestamp, and comment (optional)
Emits an audit log entry with the approval batch size

5. Export

Click Export to generate a downloadable artifact of the completed questionnaire. The export packages each question with its approved answer and linked sources in a structured format suitable for copy-paste into the requesting vendor’s intake form.

What This Module Does Not Do (beta)

Per Plan 272 D1 — Questionnaire product honesty:

❌ There is no Answer Library panel or feature
❌ There is no Reviewer Assignments assignment UI (questions are reviewed by whoever has permission; not assigned per-question)
❌ There are no inline Comments threads on questions
❌ There are no Templates (a library of pre-built questionnaire templates)
❌ There is no Send-to-Requestor outbound flow
❌ There is no Settings page beyond the standard compliance module settings
❌ There is no multi-format upload (Excel/Word/PDF/CSV/SIG/CAIQ parsing is stubbed; the real supported format is a structured JSON payload that’s POSTed from an upload step)
❌ There is no real LLM autofill — current answers are template-generated; confidence is computed from control-count, not from model uncertainty
❌ The 0.90+ confidence scores seen in demos/mockups don’t occur in production — the template generator caps confidence at 0.85

These are not roadmap promises that slipped. They are features that were in earlier documentation drafts and never built. This page is the corrected truth. Plan 276 tracks the path to real LLM autofill + many of the additional features the earlier doc claimed.

Confidence Scores — The Honest Version

A draft answer’s confidence value reflects how many controls in your frameworks matched the question’s category:

confidence = min(0.85, 0.5 + n_matching_controls × 0.05)

0 matching controls → 0.50 (generic template answer)
1 matching control → 0.55
5 matching controls → 0.75
7+ matching controls → 0.85 (capped)

The score is a rough “how many citations did we find,” not a model-uncertainty estimate. Banding these into “High / Medium / Low” visually can help reviewers prioritize — but the numbers are not calibrated against answer accuracy; they correlate with citation density, which is a proxy.

FAQs

Is this using AI?

Not today, not at beta. Current answer generation is template-based pre-fill — keyword matching against compliance categories, cited against your existing controls, with a formulaic confidence score. Real LLM autofill with grounded prose and citation fencing is planned for Plan 276 (post-beta). The current behavior is still useful — the cited controls and category guess get the reviewer 80% of the way, and bulk-approve on structurally valid drafts is fast — but it’s not AI in the way the earlier marketing implied.

Why is every confidence score between 0.50 and 0.85?

That’s the formula. min(0.85, 0.5 + n_controls × 0.05). The range is narrow because the metric is control-citation density, not accuracy. Don’t read “0.80” as “80% likely to be correct” — read it as “we found 6 cited controls for this question’s category.” A reviewer judging accuracy of the actual answer is always required before export.

Can I send the questionnaire to the requesting vendor directly?

No — there’s no “Send to Requestor” outbound flow at beta. Use the Export feature to download the completed questionnaire as a structured file, then deliver it through whatever channel the requestor asked for (email, their portal, etc.). Outbound automation is tracked post-beta.

What happens if generation fails on a question?

Per-question failures don’t abort the batch — the failed question is logged with its error, counted in the partial-completion log line, and left in its previous status for manual review. The questionnaire still transitions to completed if at least one question succeeded. If every question fails (e.g. the tenant has zero active frameworks), the questionnaire transitions to failed with an explicit error message and the reviewer gets a business-logic error on the frontend.

Can I edit answers after they’re approved?

Yes — approved questions can be moved back to drafted by a reviewer with edit permission. The audit log records the un-approval. After editing, the question goes through approval again. This is meant for corrections after export feedback from the requesting vendor, not routine editing.

Compliance Frameworks — the controls that get cited in questionnaire answers
Policy hub — policies that back the cited controls
Plan 276 — post-beta roadmap — real LLM autofill and the features listed in “What this module does NOT do”