Most security teams have an answer library, even if they do not call it one. It might be a shared spreadsheet of past responses, a wiki page, or a folder of completed questionnaires. It exists because answering the same questions from scratch is exhausting. The trouble is that most of these libraries would not survive scrutiny from an auditor, or from a customer's assessor who asks, politely, how you know an answer is still true.
Here is a practical standard for an answer library that would hold up: what each entry must contain, who may approve it, and when it should be reviewed again.
What an entry must contain
An entry is more than a question and an answer. To be defensible, each one needs:
- The canonical question, written in neutral language so it matches the many ways customers phrase it.
- The approved answer, written in your company's voice, specific enough to quote.
- Citations to the exact source passages that support each claim in the answer.
- The name of the person who approved it, and the date.
- A last-reviewed date, and the review date of each cited source.
Citations are the part teams skip, and they are the part that matters most. Without them, the library is a collection of assertions. With them, any reviewer can check an entry in under a minute by reading the highlighted passage.
Who may approve
Separate drafting from approval. Anyone close to the work, a sales engineer or a security analyst, can propose an entry. Approval should belong to someone accountable for the control in question, usually the security lead, with legal or finance approving entries about contracts, insurance, or commercial commitments.
Record the approval. An auditor does not need to see every edit, but they will want to know that an approved answer had an approver, and that the approver had the evidence in front of them. A simple log of who approved what, and when, travels with every export and answers that question before it is asked.
What does not belong in the library
Some answers should never be reused automatically:
- Answers that depend on a specific customer contract, such as negotiated notification windows.
- Statements about certifications or authorizations you do not currently hold, even phrased as plans.
- Roadmap commitments and dates.
- Any answer whose source has been deleted or has passed its review date.
These belong with an owner every time. Treating them as gaps is not a weakness of the library; it is what keeps the rest of it trustworthy.
When entries expire
Tie review to evidence, not to the calendar alone. An entry should come up for review when any of its cited passages changes, when a cited source passes its review date, or after twelve months, whichever comes first. If the source changed in a way that alters the answer, the entry is rewritten and re-approved. If not, re-approval takes a minute and refreshes the last-reviewed date.
This is where a library connected to its sources beats a spreadsheet. When the backup policy is updated, you can list every library entry that cited it. When a policy is retired, every entry that depended on it is flagged instead of quietly surviving.
Reuse with a check, not on faith
The point of a library is speed, and speed should not mean skipping verification. When a new questionnaire asks a question that matches a library entry, the entry is a strong draft: check that its sources still exist and still say what they said, then approve. That is the behavior we built into Attestloom. A library answer is reused only when its cited passages are still present in your sources, and it arrives with its citations so the reviewer sees the evidence alongside the text.
A short checklist
- Every entry cites passages, not documents.
- Every entry has a named approver and an approval date.
- Every cited source has an owner and a review date.
- Contractual, insurance, and certification answers are routed to owners, not reused.
- Entries are reviewed when their evidence changes, and at least yearly.
Build the library this way and something useful happens: the next time an assessor asks how you know an answer is still accurate, the answer is already in the export.
Keep reading
See it work on a sample questionnaire in the live demo.