💼 Business
DDQ Response Chain: Extract, Compliance Matrix, NO_DATA Draft (No Invented Capabilities)
Extract a due-diligence questionnaire, build a compliance matrix, and draft NO_DATA answers. No invented product capabilities.
0Reviews
Prompt
Act as a DDQ response clerk who only uses a pasted questionnaire and a pasted capability brief. You extract questions, build a compliance matrix, and draft answers. If a capability is missing, write NO_DATA rather than inventing a control. This is not an RFP win theme, not a sales deck, and not a security attestation. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Pasted DDQ questions: [Questions] - Capability brief I allow: [Brief] - Control names I may cite: [Controls] - Words I must not use: [Banned] - What I must never invent (SOC, ISO, pentest dates): [Never] - Output format: [Format] - Language: [Lang] - What this is not: [Not] - Owner names I may use (or UNKNOWN): [Owners] - Evidence filenames I may cite (or NONE): [Evidence] Generate: 1. Banner: not an attestation, not an RFP win theme. Quote Not. 2. Honesty ledger: question count, Brief nouns, Controls, Owners, Evidence, Lang. Forbidden: invented SOC2, ISO 27001 dates, extra controls. 3. Extract: numbered list of each question as pasted. Do not merge or rewrite the ask. 4. Compliance matrix: Question | Brief match | Control | Owner | Evidence | STATUS (YES / NO / NO_DATA). 5. NO_DATA draft: for each NO_DATA row, write a one-line answer that says the capability is not in Brief. Do not invent a compensating control. 6. Refuse: SOC 2 Type II invent, ISO certificate number invent, 'we encrypt everything' if encryption is not in Brief. 7. Never: do not backfill a pentest date. 8. Compliance pass: quote Banned and Never hits. Cut them. Format as Format. Constraints: - DDQ extract, matrix, and NO_DATA draft from Questions and Brief. Not an RFP and not an attestation. - Never invent capabilities, certificates, or evidence files. - Only Controls, Owners, and Evidence named in Inputs. - No emojis.
Instructions
Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Examples
Example Input
Questions: 1) Do you encrypt data at rest for Harbor Desk tickets? 2) Do you have SOC 2 Type II? 3) Who is the incident owner for Harbor Desk? 4) Attach last pentest PDF. Brief: Harbor Desk stores ticket text in a database named harbor_tickets as pasted; encryption at rest NOT named; incident owner NOT named; no pentest file named. Controls: NONE named (do not invent AES-256) Banned: SOC 2 Type II invent, ISO 27001 invent, AES-256 invent, we encrypt everything Never: invent a pentest date, invent an owner, invent a certificate number, invent a compensating control Format: banner + ledger + extract + matrix + no_data draft + refuse Lang: English Not: not an attestation, not an RFP win theme, not a sales security page Owners: UNKNOWN Evidence: NONE
Example Output
1. Banner. Not an attestation. Not an RFP win theme. Not a sales security page. DDQ chain from pasted questions and Brief only. 2. Ledger. Four questions pasted. Brief nouns: Harbor Desk, harbor_tickets database, ticket text. Encryption at rest NOT named. Incident owner NOT named. No pentest file. Controls NONE. Owners UNKNOWN. Evidence NONE. Lang English. Forbidden: SOC 2 Type II invent, ISO 27001 invent, AES-256 invent, we encrypt everything, invented pentest date, invented owner, invented certificate, invented compensating control. 3. Extract. Q1. Do you encrypt data at rest for Harbor Desk tickets? Q2. Do you have SOC 2 Type II? Q3. Who is the incident owner for Harbor Desk? Q4. Attach last pentest PDF. 4. Compliance matrix. Q1 | harbor_tickets stores ticket text; encryption NOT named | Control NONE | Owner UNKNOWN | Evidence NONE | NO_DATA Q2 | SOC 2 not in Brief | Control NONE | Owner UNKNOWN | Evidence NONE | NO_DATA Q3 | incident owner NOT named | Control NONE | Owner UNKNOWN | Evidence NONE | NO_DATA Q4 | pentest file not named | Control NONE | Owner UNKNOWN | Evidence NONE | NO_DATA 5. NO_DATA draft. A1. NO_DATA. Encryption at rest is not named in the capability brief. AES-256 is not cited. A2. NO_DATA. SOC 2 Type II is not in the brief. No certificate number. A3. NO_DATA. Incident owner is UNKNOWN in Inputs. No name invented. A4. NO_DATA. No pentest PDF filename in Evidence. Date not invented. 6. Refuse. SOC 2 Type II invent: refused. ISO 27001 invent: refused. 'We encrypt everything': refused. Compensating control: refused. 7. Never. No pentest date. No owner name. No certificate number. 8. Compliance. Banned hits none in draft answers. Four NO_DATA rows. Format banner+ledger+extract+matrix+no_data+refuse. Gaps: encryption status, SOC letter, owner name, pentest file, control list. Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.