Skip to content
LQ.AI

Answer security and procurement questions

Reference
  • evaluator
  • operator

Status: Stub at v1 launch. The Procurement-Readiness Pack — pre-filled SIG Lite and CAIQ questionnaires, plus a cover letter template — is tracked as DE-086 and is welcomed as a community contribution.

In short

Section titled “In short”
  • Base every answer on what’s actually running in your own deployment — a planned feature or a written policy is not evidence that a control is working.
  • For a provider’s retention terms, contracts, or certifications, get current evidence from that provider directly; LQ.AI’s own settings can’t confirm those commitments on the provider’s behalf.
  • What’s here today is a starter, not the full pack: sig-lite.md answers the SIG Lite questions tied to privileged-matter handling and the M3 external integrations (the Word add-in, the Slack/Teams bridges); CAIQ and a cover letter template are still DE-086.
  • Replace every [OPERATOR-CONFIGURABLE] marker with your deployment’s actual answer, and keep each question, response, and evidence reference together.

Procurement reviews are one of the highest-leverage adoption barriers for any tool deployed in enterprise environments — including open-source software the operator runs themselves. In-house counsel evaluating LQ.AI for use in their organization typically need to satisfy their procurement team’s standard intake process, which involves SIG Lite (Standardized Information Gathering Lite from Shared Assessments), CAIQ (Consensus Assessments Initiative Questionnaire from Cloud Security Alliance), or a custom enterprise security questionnaire.

The Procurement-Readiness Pack is the project’s contribution to that work: pre-filled responses for the most common procurement questionnaires, with operator-overridable fields for items that depend on specific deployment configuration.

What lands here

Section titled “What lands here”

sig-lite.md

Status
Starter (M2-D3) — privileged-matter handling only; full pack DE-086
Description
Pre-filled SIG Lite responses calibrated to the typical LQ.AI deployment. The M2-D3 starter covers the data-protection + audit questions whose answers depend on the privileged-project handling; community contributions fill in the remaining ~15 SIG Lite domains.

caiq.md

Status
TBD (DE-086)
Description
Pre-filled CAIQ Lite questionnaire mapped to CSA Cloud Controls Matrix.

cover-letter.md

Status
TBD
Description
Sample cover letter the operator can adapt for their procurement team — explains what LQ.AI is, why it’s an unusual procurement (self-hosted open source rather than SaaS), and points at relevant artifacts.

aup-soc-template.md

Status
Future
Description
Template Acceptable Use Policy and Statement of Operational Controls the operator can adapt for their internal AI-governance program.

Format

Section titled “Format”

Each questionnaire response follows this format:

  • Question as it appears in the source questionnaire.
  • Project response — the answer that applies to a typical LQ.AI deployment.
  • Operator-configurable items marked [OPERATOR-CONFIGURABLE] where the answer depends on the operator’s specific configuration. The marker is followed by a description of what the operator should fill in.
  • References to relevant PRD sections, Compliance Alignment Pack control mappings, or Pre-Empted Procurement Objections in PRD Appendix E.

Why “operator-configurable”?

Section titled “Why “operator-configurable”?”

LQ.AI is not a SaaS vendor. It is software the operator runs in their own environment. Many procurement questionnaire questions assume a SaaS context (“Where is the data stored? In which AWS region?”) and the answer for LQ.AI is “wherever the operator chose to deploy” — which the project cannot pre-fill on the operator’s behalf.

The [OPERATOR-CONFIGURABLE] marker makes this explicit. The operator answers the question for their specific deployment; the project provides the structure and the boilerplate that doesn’t change across deployments.

Section titled “Related procurement-defense materials”

Contributing

Section titled “Contributing”

Procurement-readiness materials are one of the highest-leverage community contribution targets — every operator who has completed a procurement cycle has substantive material that helps the next operator. The contribution path:

  1. Open an issue (or pick up DE-086 / Issue 10 when published) describing what you have.
  2. Draft the response in your fork following the format above.
  3. Mark operator-configurable items consistently.
  4. Submit a PR; counsel review applies (procurement responses are reviewed for legal accuracy before merge).

If you completed a procurement cycle for your organization’s LQ.AI deployment and want to contribute the responses back without doing extra anonymization work, that’s the highest-value first contribution to this folder.

Pack maintained alongside the PRD. Updates land as community contributions are accepted.

Next

Section titled “Next”