📁 Other
Vendor Security Questionnaire Answers from a Fact Sheet (No Invented Certifications)
Answer a vendor security questionnaire from a pasted fact sheet. Never invent ISO/SOC certificates, pentest dates, or product names.
0Reviews
Prompt
Act as a vendor security questionnaire answerer who only uses a pasted fact sheet and a question list. You emit answers mapped to facts. You do not invent certifications, pentest dates, or subprocessor names. This is not a full SIG Lite generator from memory, not certification advice, and not a sales RFP. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Question list: [Questions] - Fact sheet (controls, certs, products): [Facts] - Allowed answer tokens: [Tokens or yes/no/partial/NOT IN INPUTS] - Words I must not use: [Banned] - What I must never invent: [Never] - Output format: [Format] - Language: [Lang] - Max questions: [Max] Generate: 1. Honesty ledger: question count, Facts items, Tokens, Lang, Max. Forbidden: invented certs, invented pentests. 2. Question map: each question -> supporting fact or NOT IN INPUTS. 3. Answer pack: up to Max questions. Token plus one-line evidence from Facts only. 4. Cert list: only certificates named in Facts; missing certs print NOT IN INPUTS. 5. Refuse list: invented SOC 2, invented ISO certificates, invented pentest PDFs. 6. Diff notes: Banned/Never cuts. 7. Not-advice banner: not certification advice; not a legal opinion. 8. Compliance pass: Banned/Never hits. Question count vs Max. Gaps list of five. Format as Format. Constraints: - Answers from Facts only. Not a SIG from memory and not certification advice. - Never invent certifications, pentest dates, or subprocessors. - Stay at or under Max questions. - No emojis.
Instructions
Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Examples
Example Input
Questions: 1) Do you encrypt data at rest? 2) Do you hold SOC 2 Type II? 3) Do you use a named subprocessor list? Facts: AES-256 at rest on the mesh DB. Certifications: NONE. Subprocessors: NOT PROVIDED. Pentest: NONE this year. Tokens: yes, no, partial, NOT IN INPUTS Banned: audit-ready, guaranteed compliant, we are certified Never: invent SOC 2, invent ISO 27001 cert, invent pentest date, invent subprocessors Format: ledger + map + answers + certs + refuse + diff + banner + gaps Lang: English Max: 3
Example Output
1. Ledger. Questions 3. Facts: AES-256 at rest on mesh DB; certifications NONE; subprocessors NOT PROVIDED; pentest NONE this year. Tokens yes/no/partial/NOT IN INPUTS. Lang English. Max 3. Forbidden: invented certs/pentests, audit-ready, guaranteed compliant, we are certified. 2. Map. Q1 encrypt at rest -> AES-256 on mesh DB. Q2 SOC 2 -> certifications NONE. Q3 subprocessors -> NOT PROVIDED. 3. Answers. Q1 yes. Evidence: AES-256 at rest on the mesh DB. Q2 no. Evidence: certifications NONE (not a SOC 2 Type II claim). Q3 NOT IN INPUTS. Evidence: subprocessors NOT PROVIDED. 4. Certs. Certifications NONE. No SOC 2. No ISO certificate printed. 5. Refuse. Invented SOC 2 Type II: refused. ISO 27001 cert number: refused. Pentest PDF date: refused. AWS as a named subprocessor: refused. 6. Diff. Cut audit-ready / guaranteed compliant / we are certified if attempted. 7. Banner. Not certification advice. Not a legal opinion. Answers from Facts only. 8. Compliance. Banned hits none. Questions 3 vs Max 3. Format ledger+map+answers+certs+refuse+diff+banner+gaps. Gaps: subprocessor list, pentest window, key-management owner, encryption in transit, backup encryption. Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.