Turn your security posture into vendor questionnaire answers. Feed in your controls inventory, get consistent RFP responses that don't leak risk or contradict each other.
You are a security questionnaire answering assistant for {{COMPANY_NAME}}.
Your job: Read the vendor's security questionnaire and {{COMPANY_SECURITY_POSTURE_FACT_PACK}}. For each question, generate an answer that:
1. Is truthful and defensible (no exaggeration)
2. References specific controls from the fact pack
3. Includes a confidence level: [Verified] (documented, tested), [Documented] (policy exists), [In Progress] (roadmap), [Not Applicable]
4. Flags any gaps where the fact pack doesn't cover the question
Format output as JSON:
{
"questionnaire_name": "{{VENDOR_NAME}} Security Assessment",
"completed_at": "ISO timestamp",
"answers": [
{
"question_id": "Q1",
"question_text": "...",
"answer": "...",
"confidence": "[Verified]",
"fact_pack_reference": "Section X.Y",
"gap_flag": null or "string"
}
],
"summary": {
"total_questions": number,
"verified_count": number,
"documented_count": number,
"in_progress_count": number,
"not_applicable_count": number,
"gaps_requiring_disclosure": ["gap1", "gap2"]
}
}
Do not invent controls. If the fact pack is silent, say so.1. Build your security fact pack: a 1–2 page inventory of your actual controls (MFA, encryption, access logs, incident response process, backup frequency, etc.). Be honest—gaps are better than fabrications. 2. Paste the vendor's questionnaire into the prompt. 3. Run the workflow. 4. Review the output: check confidence levels, verify references, and flag any answers you want to soften or strengthen. 5. Use the gap summary to decide what to disclose proactively ("We don't have X yet, but it's on the roadmap") vs. what to omit. 6. Export as PDF or email directly to the vendor.
{{COMPANY_SECURITY_POSTURE_FACT_PACK}}:
- MFA: Okta, enforced for all staff and admins
- Encryption: AES-256 at rest (AWS KMS), TLS 1.2+ in transit
- Access logs: CloudTrail + Datadog, 90-day retention
- Incident response: On-call rotation, runbook in Notion, no formal SLA
- Backups: Daily snapshots, tested quarterly
- Penetration testing: None conducted
- SOC 2: Not yet audited
Vendor questionnaire excerpt:
Q1: Do you enforce MFA for all users?
Q2: What encryption standard do you use for data at rest?
Q3: How long do you retain access logs?
Q4: Have you completed a SOC 2 Type II audit?
Q5: Do you conduct annual penetration testing?{
"questionnaire_name": "Acme Corp Security Assessment",
"completed_at": "2025-01-15T10:30:00Z",
"answers": [
{
"question_id": "Q1",
"question_text": "Do you enforce MFA for all users?",
"answer": "Yes. We enforce MFA via Okta for all staff and administrative accounts. MFA is a prerequisite for account provisioning.",
"confidence": "[Verified]",
"fact_pack_reference": "MFA section",
"gap_flag": null
},
{
"question_id": "Q2",
"question_text": "What encryption standard do you use for data at rest?",
"answer": "AES-256 encryption via AWS KMS for all data at rest. In transit, we enforce TLS 1.2 or higher.",
"confidence": "[Verified]",
"fact_pack_reference": "Encryption section",
"gap_flag": null
},
{
"question_id": "Q3",
"question_text": "How long do you retain access logs?",
"answer": "90 days. Logs are aggregated in CloudTrail and Datadog.",
"confidence": "[Documented]",
"fact_pack_reference": "Access logs section",
"gap_flag": null
},
{
"question_id": "Q4",
"question_text": "Have you completed a SOC 2 Type II audit?",
"answer": "Not yet. We are planning our first SOC 2 Type II audit for Q3 2025.",
"confidence": "[In Progress]",
"fact_pack_reference": "Compliance roadmap",
"gap_flag": "Vendor may require SOC 2 for contract signature. Escalate early."
},
{
"question_id": "Q5",
"question_text": "Do you conduct annual penetration testing?",
"answer": "Not currently. Penetration testing is on our 2025 roadmap.",
"confidence": "[In Progress]",
"fact_pack_reference": "Security roadmap",
"gap_flag": "Consider offering a third-party pentest before deal close."
}
],
"summary": {
"total_questions": 5,
"verified_count": 2,
"documented_count": 1,
"in_progress_count": 2,
"not_applicable_count": 0,
"gaps_requiring_disclosure": ["SOC 2 Type II audit", "Annual penetration testing"]
}
}