Citesheet fills your Excel questionnaire from your own documents. Each answer has a word-for-word quote. No proof, no answer.
First questionnaire free. Same-day turnaround.
| ID | Question | Answer | Explanation and source |
|---|---|---|---|
| LOG-03.1 | Are security-related events identified and monitored within applications and the underlying infrastructure? | Answer: Yes | The company mandates capturing security-relevant events across product and infrastructure, and security logs are generated by applications and systems for monitoring and incident response. |
| BCR-01.2 | Are the policies and procedures reviewed and updated at least annually? | Answer: Yes | Policies and procedures are required to be reviewed and approved on at least an annual basis. |
| HRS-11.2 | Are regular security awareness training updates provided? | Answer: Yes | Regular security awareness training updates are provided through annual security awareness training and quarterly phishing simulations and training. |
| CCC-07.1 | Are detection measures implemented with proactive notification if changes deviate from established baselines? | Answer: Partial | The policies document that security detection controls identify events outside of established security baselines, but they do not prove that proactive notifications are implemented for these deviations. Needs review. Check: partial coverage. Evidence showing that proactive notifications are sent when changes deviate from established baselines. |
| DSP-17.1 | Are processes, procedures, and technical measures defined and implemented to protect sensitive data throughout its lifecycle? | Answer: Yes | The provided documents confirm that processes, standards, and technical measures are established to protect sensitive data throughout its lifecycle, including data classification and software development lifecycle policies. |
| HRS-07.1 | Are employees required to sign an employment agreement before gaining access to organizational information systems, resources, and assets? | Answer: — | No proof found We found nothing in your documents to support an answer, so we left it empty. |
Your policies as PDF, Word or Markdown. They are the only source of answers.
The Excel file you were sent, such as a CAIQ.
Same file, same layout. Each answer has a quote and its document. You review the Needs review rows before you send it.
In the pilot, you send us the files and we run these steps with you.
We fill your Excel file. We don't rebuild it. Questions, layout and dropdowns stay as they were, and before it goes back to you we check that nothing outside the answer cells changed.
Each answer links to the exact words in your document. Code then checks those words exist in it, word for word. We never paraphrase and call it a quote. Pick a question to see where its answer comes from.
…
Definitions
GitLab Team members: users with a gitlab.com email address
Contractors/TSPs and Consultants: Personnel who are external to GitLab who do not have a gitlab.com email address and are under a contract/agreement that involves handling, managing, storing, or transmitting GitLab data in support of GitLab's statutory, regulatory and contractual requirements.
Roles & Responsibilities
Standard
All GitLab Team members and contractors/TSPs are required to participate in GitLab's General Security Awareness Training, New Hire Training and on-going phishing simulations and training, or show evidence of equivalent training completion within the calendar year. Security Trainings that require participation include the following:
New Hire Security Training
New Hire Security Training is required to be completed by all GitLab Team Members and contractors/TSPs during their onboarding at GitLab. This security training provides new hires with the knowledge to identify cybersecurity threats, vulnerabilities, and attacks.
General Security Awareness Training (GSAT)
The GitLab security awareness training program provides ongoing training to GitLab team members that enhances knowledge and identification of cybersecurity threats, vulnerabilities, and attacks as well as satisfying external regulatory requirements. GitLab's handbook-first General Security Awareness Training is provided annually via Right Hand Cybersecurity, GitLab's third-party provider, and requires participation and completion by all GitLab Team Members and contractors/TSPs.
Exceptions during the active campaign will be made for GitLab team members on extended leave.
Phishing Training
The GitLab Phishing Training Program is designed to educate and evaluate GitLab's ability to detect and prevent phishing attempts. Ongoing phishing simulations and trainings are conducted once per quarter via Right Hand Cybersecurity, GitLab's third-party provider, and requires participation and completion by all assigned GitLab Team Members and contractors/TSPs.
Remember: If you see something, say something, and always report suspicious emails via PhishArm.
Secure Coding Training
The GitLab Secure Coding Training is a required training completed by a sub-group of GitLab Team Members and contractors/TSPs in the Engineering Department. This training contains descriptions and Secure Coding Guidelines from OWASP (Open Web Application Security Project) addressing security vulnerabilities commonly identified in the GitLab codebase. This training is intended to help developers identify potential security vulnerabilities early, with the goal of reducing the number of vulnerabilities released over time.
Exceptions during the active campaign will be made for GitLab team members on extended leave.
Other Security Trainings
…
Real rows from GitLab's public policies. If the words are not in the document, the answer does not ship.
When your documents say nothing, the row stays empty and says so. When they only half-prove it, the row says what to check. Nothing is guessed.
HRS-07.1
Are employees required to sign an employment agreement before gaining access to organizational information systems, resources, and assets?
We found nothing in your documents to support an answer, so we left it empty. It goes on your gap list.
Needs review · CCC-07.1
Are detection measures implemented with proactive notification if changes deviate from established baselines?
Check: partial coverage. Evidence showing that proactive notifications are sent when changes deviate from established baselines.
Partial evidence, two documents that disagree, or a sensitive topic such as legal commitments. Each row says why.
Unanswered questions in one place, so you know which policy to write next. In the pilot, we send it to you by hand.
You decide: edit or approve any answer. A re-run never overwrites what you changed.
What happens to the policies and questionnaires you send us.
Your documents answer your questionnaires. Nothing else.
The AI step runs on Google's paid Gemini API. Not used for training.
Connections use HTTPS. Stored files and answers are encrypted.
Tell us, and your documents and answers are removed.
We'll sign yours before you send anything.
Citesheet is early, so you work directly with the person who built it. Send one real questionnaire and judge it on that.
Send a real one and judge it on that.
The filled file, the quotes and the flagged rows come back the same day.
No fixed prices yet. Talk to us. Send a message.
It can draft one, but a quote is required, and code checks that the quote exists word for word in your document. If there is no proof, the row says “No proof found.”
Partial evidence and conflicting documents are marked Needs review, with a “Check:” line saying why. You review those rows. Missing proof goes on the gap list.
Yes, for flagged rows and anything sensitive, such as legal commitments or breaches. You can edit or approve each answer, and a re-run never overwrites what you changed.
No. Your questions, layout and dropdowns come back unchanged. We verify that before you download.
They are used only for your questionnaires. The AI step is Google Gemini on the paid tier, which is not used for training. Data is encrypted in transit and at rest, deleted on request, and we sign an NDA on request.
Your first questionnaire is free, with same-day turnaround. After that it is pilot pricing. Talk to us.
First questionnaire free. Same-day turnaround. Tell us where to send it back and we'll reply with next steps.
Takes about 15 seconds. Or email hello@citesheet.com.
Need an NDA first? Ask, and we'll sign before you send anything.