First-Draft Security and RFP Answers From Your Own Docs

The stack

The problem

Security questionnaires and RFPs are deal-blockers that quietly eat days right when momentum matters most. A 200-question security review lands late in a hot cycle, the AE pings engineering and security, answers trickle in over a week between everyone's real jobs, and the deal stalls precisely when it should be accelerating. Worse, the same answers get re-typed from scratch for every single deal because nobody maintains a clean, current answer library, so the team pays the full cost every time.

Nearly every answer already exists somewhere in your own documents. Your SOC 2 report, your security policy, your DPA, your architecture docs, and your previously completed and approved questionnaires already contain the truth. The work is finding the right approved language and rephrasing it to fit each new questionnaire's specific wording and format, not figuring out the answer from scratch. That is retrieval and rephrasing, which is exactly what AI is good at, as long as it draws only from your real documents and never invents a control you do not actually have.

Pointing an AI at your own approved source documents lets it first-draft each answer in the new questionnaire's format, cite which document the answer came from, and flag anything the docs cannot answer for a human to handle. Security still reviews everything, but they review and approve drafts in hours instead of writing from a blank page over days. The flagged-and-low-confidence rows tell expert reviewers exactly where to spend their limited time.

The downside here is severe, so this is built around source-only answering and mandatory human sign-off, full stop. A hallucinated security claim, an AI confidently asserting a certification or a control you do not have, is not a minor error. It is a compliance violation, a breach of contract waiting to happen, and a trust catastrophe with a customer's security team. The prompt is engineered to refuse rather than guess, and a human is accountable for every answer that gets submitted. There is no version of this that auto-submits.

How it works

• Assemble your approved, current security and compliance docs into one source-of-truth library
• Load the source docs into a Claude Project for persistent context, with a ChatGPT file upload as a fallback
• Get the incoming questionnaire into a clean, structured list with the expected answer format per question
• Have AI draft each answer using ONLY your source docs, citing the source and a confidence level per answer
• Route every 'NEEDS HUMAN INPUT' and low-confidence answer to the right expert; the rest just need sign-off
• Security or the accountable owner reviews and approves every answer before it goes back, then it feeds the library

The playbook

You are drafting answers to a security/RFP questionnaire using ONLY the approved company documents available to you in this Project. This is compliance-sensitive and accuracy is critical.

ABSOLUTE RULES:
- Answer ONLY from the provided documents. NEVER invent, assume, or infer a control, certification, or practice that is not explicitly supported.
- For each answer, cite the source document and section, e.g. [Source: Security Policy, sec 4.2].
- If the documents do NOT clearly and explicitly answer a question, output exactly: "NEEDS HUMAN INPUT - not covered in source docs" and DO NOT guess or hedge into an answer.
- For confidential sources (e.g. SOC 2 report contents), reference availability under NDA rather than pasting confidential detail.
- Match the requested answer format (yes/no vs free text vs pick-from-list).

QUESTIONS (batch):
{{PASTE_15-20_QUESTIONS_WITH_EXPECTED_FORMAT}}

Output a table, one row per question:
Question # | Draft answer | Source | Confidence (high / med / low)

Inside the prompt

The scoring prompt is short, but every line is there for a reason. Here is what each one is doing and why.

What you get

Drafted, sourced questionnaire answers with confidence flags and explicit human-input markers, ready for security review.

Q# | Draft answer | Source | Confidence

Q12 | Do you encrypt data at rest? | Yes. All customer data is encrypted at rest using AES-256. | [Source: Security Policy, sec 3.1] | high

Q13 | Do you hold SOC 2 Type II? | Yes. A SOC 2 Type II report is available under NDA; the most recent audit period covers the trailing 12 months. | [Source: SOC 2 Summary] | high

Q27 | Where is customer data hosted? | Customer data is hosted in AWS, primary region us-east-1, with documented data residency controls. | [Source: Architecture Overview, sec 2] | high

Q41 | Describe your incident-response SLA for customer notification. | NEEDS HUMAN INPUT - not covered in source docs | (route to Security) | low

Q55 | Do you support customer-managed encryption keys (CMEK)? | NEEDS HUMAN INPUT - not covered in source docs | (route to Engineering) | low

Summary: 51 of 60 answered at high or medium confidence from source docs; 9 routed to humans. Estimated review time: ~1 hour vs. a multi-day manual effort.

Pitfalls to avoid

Questions people ask

How do I stop the AI from inventing a control we do not actually have?

You make refusal the default behavior, not a hope. The prompt says answer ONLY from the provided documents, never infer a control or certification, and output 'NEEDS HUMAN INPUT' when the docs do not clearly cover a question. Put that instruction in the Claude Project's custom instructions so it applies to every session and is impossible to forget. A hallucinated security claim is a compliance violation, so the system is built to escalate rather than guess.

Can I just trust the high-confidence answers and skip review on those?

No. The AI drafts; a human is accountable for what gets submitted to a customer's security team. The high-confidence sourced rows should be a quick read-and-approve, not a writing task, but they still get read, because an approved-but-wrong answer is still your liability. Treat the human sign-off as the control the whole system rests on, not a formality.

What is the single best document to load into the Project?

Last quarter's completed and approved questionnaire. Those answers are pre-vetted language security has already signed off on, so the model rephrasing them carries far less risk than the model interpreting a raw policy document for the first time. Add your SOC 2 summary, security policy, and DPA alongside it, and feed every newly approved answer back into the library so each questionnaire makes the next one faster.

How much time does this actually save?

On a 60-question questionnaire, expect about 51 answers to draft cleanly at high or medium confidence from the docs and roughly 9 to route to humans. That turns a multi-day, multi-person slog into about an hour of focused review plus a few quick expert answers. The savings come from the confidence sort: the routed questions tell your experts exactly where their limited time is needed, and nowhere else.