Answer a customer's security questionnaire accurately
Drafts honest, consistent answers to a security due-diligence questionnaire from your actual controls, flagging gaps.
The prompt
Help me answer a security questionnaire from a customer or prospect.
Questions: [PASTE the questions, or a batch of them]
Our security facts: [PASTE what we have: policies, certifications (e.g. SOC 2 Type II, ISO 27001), hosting provider, encryption, MFA, backups, pen test dates, incident response, subprocessors]
Previous approved answers: [PASTE past answers - optional]
Who reviews before sending: [e.g. "CISO", "legal"]
For each question:
1. Draft a direct answer: start with Yes / No / Partial / Not applicable, then 1-3 sentences of supporting detail.
2. Point to evidence we can attach (policy name, report, screenshot) where relevant.
3. If my facts do not cover it, write [NEED INPUT: what is needed and from whom]. Never guess or claim a control we have not confirmed.
4. If the honest answer is No or Partial, add a factual note on compensating controls or roadmap only if I provided one.
Rules:
- Keep answers consistent across similar questions; flag any contradictions in my source material.
- Do not overstate: "encrypted at rest" only if confirmed, no "military-grade", no "fully compliant" claims.
- Avoid disclosing sensitive details (internal IPs, exact tool configs) beyond what the question needs.
Return a table: # | Question | Answer | Evidence | Confidence (confirmed / needs review) | Notes. Then a list of gaps to raise internally.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Legal & Compliance prompts
What to fill in
- PASTE the questions, or a batch of them
- PASTE past answers - optional
- e.g. "CISO", "legal"
- NEED INPUT: what is needed and from whom
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Write a suspicious activity report (SAR) narrativeA clear, chronological SAR narrative that answers who, what, when, where, why, and how, ready for compliance review.
- Assess a patent or invention against prior artA structured first-pass analysis of what a patent or invention claims, how it compares with known prior art, and questions for a patent attorney.
- Draft a bookkeeping or accounting engagement letterDrafts a clear engagement letter that defines scope, exclusions, client responsibilities, and fees to prevent scope creep.
- Write an audit finding management will understand and act onTurns my testing notes into a finding with condition, criteria, cause, effect, and a practical recommendation, rated by risk.