AI Security Questionnaire Agent: Cost and Rollout Worksheet

Jump to the cost worksheet if you already know the workflow. The page is for a security, engineering or operations leader scoping one response lane. It is an internal reference model, not a client result, vendor quote or recommendation to delegate corporate authority.

Choose one response workflow

Start with one questionnaire intake, one approved evidence library and one sanctioned response system. The accountable security owner defines which questions the agent may draft, which evidence sources are authoritative and which commitments always leave the workflow.

A useful first pilot handles repeatable questions about an existing control or documented practice. It does not decide whether the company complies with a framework, accept a customer's contract language, make a risk exception or sign an attestation.

Use this initial contract:

• Intake: one questionnaire file or one portal export with stable question identifiers.
• Evidence: one versioned library of policies, control descriptions, assessment records and approved public statements.
• Output: one draft packet in the response system, with the evidence used for every answer.
• Owners: one security reviewer plus named owners for the controls that may receive exceptions.
• Acceptance: the security reviewer accepts the packet, and the final system state matches the reviewed version.
• Stop rule: missing, expired or conflicting evidence never becomes a confident answer.

NIST's final Cybersecurity Framework 2.0 puts supply-chain risk inside organizational governance. Its supply-chain category covers agreed processes, roles, supplier requirements, due diligence, recorded risk and ongoing monitoring. The NIST C-SCRM quick-start guide gives buyers and suppliers a shared structure, but it does not authorize software to speak for an organization.

Keep four routes separate

Every question must end in one of four routes. A single confidence score is not enough because confidence does not distinguish evidence quality from corporate authority.

1. Draft: current, owned evidence directly supports a bounded answer. The packet retains the question, answer, evidence identifier, version and owner.
2. Review: evidence supports the substance, but the wording contains a material qualification or interpretation. A security reviewer accepts or edits it.
3. Handoff: evidence is missing, stale or contradictory. The question moves to the named control owner with the conflict intact and an acknowledgement record.
4. Refuse: the request asks for a signature, attestation, unsupported certification, contract commitment or policy override. The agent records why it stopped.

The difference between review and handoff matters. Review means the evidence exists and the wording needs accountable judgment. Handoff means the evidence problem itself needs an owner. Refusal is not a low-confidence answer. It is a deliberate authority boundary.

This is the same evidence discipline used in a broader agent workflow operating contract: the allowed action, owner, acceptance evidence and stop case are separate fields, not implied by a prompt.

Build an answer packet that can be inspected

Treat each answer as a small evidence record rather than a paragraph generated into a portal. The minimum packet should retain:

{
  "question_id": "q-042",
  "question_scope": "product-a / production / 2026-09-28",
  "draft_answer": "Encryption at rest is enabled for the named service.",
  "evidence": [
    {
      "id": "control-storage-encryption",
      "version": "2026-09-15",
      "owner": "platform-security",
      "checked_at": "2026-09-28T00:00:00Z"
    }
  ],
  "route": "review",
  "reviewer": "security-owner",
  "terminal_state": "pending"
}

The scope prevents one product's evidence from answering for another. The evidence version prevents a current-looking answer from silently depending on an old policy. The owner creates a real handoff when the source is incomplete. The terminal state makes pending, accepted, uncertain and divergent observable rather than rhetorical.

NIST's OSCAL assessment-results model is useful evidence architecture. It keeps metadata, reviewed controls, subjects, assets, attestations, logs, observations with related evidence, risks and findings distinct. A questionnaire response does not need to implement OSCAL, but collapsing all of those roles into one generated answer removes information the reviewer needs.

For software-development claims, use the final SSDF version 1.1 as a vocabulary for practices, not as proof that a specific product or company conforms. NIST's publication list still marks SSDF version 1.2 as a draft on the September 28 check date. Record the exact version behind any framework answer.

Price the accepted packet

Measure the whole response workflow for one period. Model and retrieval spend are only part of it. Evidence upkeep, integration, security review, control-owner time and rework all belong to the same numerator.

Use:

joined monthly cost = platform/runtime + evidence store + integration/operations + amortized setup + security review + control-owner review + rework

Then divide by accepted response packets plus acknowledged exception handoffs. Do not divide by questions generated. A packet counts only when the accountable reviewer accepts it and the sanctioned response system reads back the reviewed version. A handoff counts only when the named owner acknowledges it.

Blank worksheet

Synthetic arithmetic check

This fixture tests the worksheet. It is not a vendor price, industry benchmark, client result or savings forecast.

• 20 packets in one month
• $350 platform/runtime, $250 evidence store and $300 integration/operations
• $7,200 setup amortized over 12 months, or $600 for the month
• 14 security-review hours, 8 control-owner hours and 5 rework hours
• $140 synthetic loaded hourly cost
• 15 accepted packets plus 3 acknowledged handoffs

The technology cost is $900. Modelled human cost is 27 hours × $140 = $3,780. Joined monthly cost is $5,280. The denominator is 18 reconciled outcomes, so the synthetic unit cost is $293.33.

If the denominator is zero, unit cost is unavailable. Report that state directly. A zero is mathematically flattering and operationally false.

Run the four-route classifier

The working reference below is dependency-free. It does not answer a real questionnaire or validate evidence content. It proves that prohibited authority and missing evidence have explicit routes.

export function routeQuestion(input) {
  if (
    input.requestsSignature ||
    input.requestsAttestation ||
    input.requestsContractCommitment ||
    input.requestsUnsupportedCertification
  ) {
    return { route: "refuse", reason: "The request requires authority the agent does not hold" };
  }

  if (!input.questionScopeNamed || !input.evidenceOwnerNamed) {
    return { route: "hold", reason: "Scope or accountable evidence ownership is missing" };
  }

  if (!input.evidenceFound || input.evidenceConflict || input.evidenceExpired) {
    return {
      route: "handoff",
      reason: "A named control owner must resolve missing, conflicting, or stale evidence"
    };
  }

  if (input.requiresInterpretation || input.materialQualification) {
    return { route: "review", reason: "Supported wording requires security-owner review" };
  }

  return { route: "draft", reason: "The answer is directly supported by current owned evidence" };
}

The retained reference model passes 16 local cases. They cover joined cost, an empty denominator, fractional packet counts, outcomes above the cohort, signature and attestation refusal, unnamed scope, missing and conflicting evidence, qualified wording, direct drafting, incomplete and complete release gates, and observed, uncertain and divergent read-back. These are reference checks, not performance or accuracy results.

The last three states matter after the hand call. A request receipt is only acceptance. The packet becomes observed when the sanctioned system returns the same reviewed version. No read-back is uncertain. Contradictory state is divergent. The wider tool outcome verification method explains why neither state permits blind replay.

Release in twelve steps

1. Name one questionnaire source and one response destination.
2. Define the product, environment and date scope that every answer must carry.
3. Inventory the evidence sources and give each one an owner, version and freshness rule.
4. Separate factual control descriptions from certifications, attestations and contract promises.
5. Build representative questions from recent completed questionnaires without copying customer-confidential content into an unapproved environment.
6. Seed negative cases: absent evidence, expired evidence, contradictory sources, wrong product scope and unsupported certification.
7. Require exact citations for every drafted answer.
8. Require security review for material qualifications and interpretations.
9. Require named-owner acknowledgement for every evidence handoff.
10. Refuse signatures, attestations, contract commitments, risk acceptance and policy overrides.
11. Read the accepted packet back from the sanctioned response system and compare it with the reviewed intent.
12. Release only when the owner, evidence, refusal and read-back tests pass together.

Log question ID, scope, evidence versions, source owners, retrieval time, route, reviewer changes, handoff acknowledgement, output record ID and final reconciliation state. Do not log credentials or duplicate confidential questionnaire content merely because the agent can see it.

The CISA attestation resource makes the signature boundary concrete. Its common form says every field must be appropriately completed and the form must be signed by the software producer's CEO or COO, who must be an employee. An agent may prepare a packet for that signer. It cannot substitute for the signer.

Keep corporate authority outside the agent

The smallest credible pilot ends at an accepted response packet. It excludes:

• signing a questionnaire, attestation or legal certification;
• accepting contract language, security addenda or audit rights;
• claiming a certification, assessment result or product scope without current evidence;
• accepting residual risk or creating a policy exception;
• changing a control, policy or system configuration to make an answer true;
• sending a final response without named security-owner acceptance;
• treating an answer-generation metric as business acceptance.

This boundary does not reduce the value of the workflow. It concentrates automation on retrieval, evidence binding, first drafting, gap discovery and response assembly, while leaving accountable commitments with the people who own them.

Frequently asked questions