How to Draft a DDQ Response Chain with a NO_DATA Matrix
DDQ drafts mint SOC 2 Type II and AES-256. The brief had a database name and no encryption line. Write NO_DATA.
The matching generator is the DDQ Response Chain: Extract, Compliance Matrix, NO_DATA Draft (No Invented Capabilities) (Ddq Response Chain Extract Compliance Matrix No Data Draft No Invented Capabilities) prompt. Browse related cards in the PromptDig library (Browse more prompts). When a filled run survives, share the version you actually use (Share a prompt).
Extract every question before you answer
Extract a due-diligence questionnaire, build a compliance matrix, and draft NO_DATA answers. No invented product capabilities. Start by filling Inputs, not by asking the model to remember last week's run. If a field is blank, write NONE or NOT IN INPUTS and leave it blank through Generate. The card is built so the model cannot honestly invent a number, owner, URL, or command that you did not paste.
Paste these fields before you hit run:
Pasted DDQ questions: [Questions]
Capability brief I allow: [Brief]
Control names I may cite: [Controls]
Words I must not use: [Banned]
What I must never invent (SOC, ISO, pentest dates): [Never]
Output format: [Format]
Language: [Lang]
What this is not: [Not]
Owner names I may use (or UNKNOWN): [Owners]
Evidence filenames I may cite (or NONE): [Evidence]
That inventory is the honesty ledger. Anything that does not appear there is forbidden in the draft. If you catch yourself adding a nice-to-have after the run, you are no longer using the card. You are ghostwriting. Put the extra fact in Inputs and run again.
Status each row YES NO or NO_DATA
Generate is numbered on purpose. Do not skip a step because the first paragraph looked done. The early steps exist to stop later prose from smuggling claims.
Walk the Generate list in order:
- Banner: not an attestation, not an RFP win theme. Quote Not.
- Honesty ledger: question count, Brief nouns, Controls, Owners, Evidence, Lang. Forbidden: invented SOC2, ISO 27001 dates, extra controls.
- Extract: numbered list of each question as pasted. Do not merge or rewrite the ask.
- Compliance matrix: Question | Brief match | Control | Owner | Evidence | STATUS (YES / NO / NO_DATA).
- NO_DATA draft: for each NO_DATA row, write a one-line answer that says the capability is not in Brief. Do not invent a compensating control.
- Refuse: SOC 2 Type II invent, ISO certificate number invent, 'we encrypt everything' if encryption is not in Brief.
- Never: do not backfill a pentest date.
- Compliance pass: quote Banned and Never hits. Cut them. Format as Format.
If a step asks for a version lock, quote the version from Inputs in the output. If a step asks for a refuse list, keep the refuse list in the published artifact, not in a sidebar you delete. Reviewers should see what the model was not allowed to do.
Do not invent a compensating control
Most failures are the same shape: a missing field gets a confident fill. A conversion rate appears. A Gradle task appears. A flash point appears. A caption appears on a job that asked for slide text only. Your review is to search the draft for numbers, names, and commands, then grep Inputs. No match means cut.
Honor the constraints as hard stops, not vibes:
- DDQ extract, matrix, and NO_DATA draft from Questions and Brief. Not an RFP and not an attestation.
- Never invent capabilities, certificates, or evidence files.
- Only Controls, Owners, and Evidence named in Inputs.
- No emojis.
When the card says not legal advice, not certification, not an exam dump, or not a caption engine, that sentence belongs at the top of the output. Deleting it to look more finished is how you inherit risk.
Refuse certificates and pentest dates
Finish with the compliance pass the prompt already asks for. Quote the banned-word hits. Cut them. Print character counts when the job has a cap. Print word counts when the job has a budget. List gaps as gaps. Five missing facts are more useful than one smooth paragraph.
Tags on the card (ddq response chain extract, ddq compliance matrix no_data, no invented ddq capabilities) are a reminder of the job shape, not an invitation to wander into a neighboring cluster. If you need a different surface, open a different PromptDig card rather than stretching this one.
Fill the card, then run
Replace every bracket. Run on ChatGPT, Claude, or Gemini. Read the ledger first, then the artifact. If the model invents a commit, KPI, DOI, PEL, bid, or logo, discard the run. Tighten Inputs. Run again. Share the filled card that survived, not the first draft that sounded done.