Vendor Security Questionnaire Reviewer
Assess a supplier's security answers critically.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Review a vendor's security questionnaire responses for my organisation. Service they provide and the data they will handle: [SERVICE_DATA]. Their answers (paste): [VENDOR_ANSWERS]. Our minimum requirements: [OUR_REQUIREMENTS]. Compare answers with requirements in a table: Requirement | Their answer | Evidence offered | Gap or concern | Follow-up question. Identify vague answers, answers that avoid the question, claims of certifications without scope details, and missing items. Rate overall risk as low, medium or high with the reasoning, and list conditions that would reduce it (contract clauses, data limits, review dates). Write the follow-up email in 150 words. Note which claims need independent evidence such as audit reports and mark them [VERIFY]. Do not assume a certification means all controls are effective. Add a scoring approach for repeated vendors, so that results can be compared over time, and a list of five answers that should always trigger a follow-up call, such as no incident response plan or no multi-factor sign-in for administrators. Provide a short summary format for management, in three sentences and a risk rating. Add a worked example using three invented vendor answers: a claim of encryption with no detail of keys, a certification with no scope statement, and a refusal to share an audit report. For each show the gap, the follow-up question, the evidence that would settle it, and the risk rating effect. Provide a scoring scheme with weights for ten control areas so that vendors can be compared over time, and a rule for which score requires an executive sign-off. Add the structure of a short risk acceptance record: what the vendor will do, which requirements are not met, the compensating control, the person accepting, and the review date. Close with a renewal checklist for existing vendors that asks what has changed since the last review. Keep everything defensive: help me protect, detect and recover, and decline anything that would help someone break into systems I do not own.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.