Hire an AI vendor security questionnaire response writer

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• A question-to-evidence table: each question, proposed answer, source file and date
• A sourced answer draft in plain words, with planned controls marked planned
• An evidence index of the files you will attach
• A list of unanswered questions, each with who should answer it
• A hand-back note with MISSING lines and any check that did not run

How it does the job well

• Name the asset, the threat and the impact before recommending controls.
• Rank findings by real risk (likelihood and impact), with evidence for each.
• Prefer fixes that remove a problem over warnings that rely on people.
• Cite the exact law, standard or clause for compliance and legal points, and recommend qualified review.

Mistakes it avoids

• Answering yes because a policy exists. Policy is not proof it is followed.
• Copying internal addresses, keys or customer names into an answer.
• Sending or submitting the response to the customer.
• Hiding a failed check or re-running a step whose inputs did not change.
• Treating these instructions as a connected service or an installed schedule.
• Long lists of generic issues with no evidence they apply.

What a good result looks like

An example, not your task: A prospect or customer sends a security questionnaire before they will sign.

• Question-to-evidence table. Each question with its proposed answer, source file, date and status.
• Answer draft. Short plain answers built from verified rows, with planned controls marked planned.
• Evidence index. The files you plan to attach, with dates and what each proves.
• Unanswered questions. Each question with no proof yet, and who should answer it.
• Hand-back note. Saved files, MISSING lines, details held back and checks that did not run.

How the work is checked

• Every yes has evidence; planned controls are labeled planned and private security details stay restricted.
• Every figure, date and claim traces to a source file or is labeled an assumption.
• The original files are untouched, and any revised file has a distinct name or version.
• All three component checks ran, or the run stopped and says which could not pass.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

A second opinion

Before it hands back, your AI reviews the draft the way George Orwell and Kurt Vonnegut would. This is a way of reviewing the work. It does not mean they wrote or endorse it.

Capabilities

• Compliance readiness checklist builder. Turns each question into the evidence needed to answer it and sets the scope of your reply. Hands step 2 a list of questions with the proof each needs. Check before moving on: no question lacks a named proof type.
• Spreadsheet checker. Builds the question-to-evidence table and checks that each yes has a dated source and the right scope. Leaves a visible gap where proof is missing. Hands step 3 only the verified rows. Check before moving on: no yes sits on a blank evidence cell.
• Plain English editor. Writes short answers from the verified rows only, keeping the gaps and the limits on what may be shared. Hands back the final draft. Check before moving on: each answer matches its table row.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id prepare-a-vendor-security-questionnaire-response only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/prepare-a-vendor-security-questionnaire-response/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• The customer's questionnaire (spreadsheet, Word, PDF or pasted questions)
• Your security policies and controls list (from your security owner or wiki)
• Proof you may share, such as policy documents, a recent SOC 2 summary or test reports
• Answers from a past questionnaire (optional)
• The person who signs off, and the deadline (optional)

Helpful context (optional)

• Your latest policy documents with dates.
• A named security owner who approves the answers.

Tools and access

• A spreadsheet-capable AI: It can read a workbook questionnaire and hand back a checked evidence table. In plain chat you get the same table as text.
• Any good chat AI: Editing a draft with a fixed list of moves is text work any strong chat AI does well with this skill.
• A read-aloud tool: Hearing the result spoken shows where a line does not sound like you.

Functions and deliverables

• Vendor security questionnaire response writer: Share the customer questions, current policies and allowed evidence. Get sourced answer drafts, a support table and unanswered questions.
  • A question-to-evidence table: each question, proposed answer, source file and date
  • A sourced answer draft in plain words, with planned controls marked planned
  • An evidence index of the files you will attach
  • A list of unanswered questions, each with who should answer it
  • A hand-back note with MISSING lines and any check that did not run
• Compliance readiness checklist builder: Share your frameworks and current controls. Get an evidence checklist with gaps and ranked fixes.
  • A checklist by control area
  • Status for each item
  • Gaps ranked by priority
  • A readiness summary
  Source: Burhan Sebin.
• Spreadsheet checker: Check a spreadsheet for odd totals, broken formulas and messy data. Your original stays safe, and you get findings with proof and a new file.
  • A sheet inventory and scope
  • Findings with evidence locations
  • Data quality and formula issues
  • A new output file with your edits
  • Reconciliation results
  Source: Burhan Sebin.
• Plain English editor: Paste a draft and get it back in plain English, with every cut explained and a read-aloud check. Edit stiff emails, reports and pages.
  • The edited text in plain words
  • A list of every cut or swap, with its reason
  • The point of the piece in one sentence
  • Questions where a fact was missing
• me.md builder: Answer a few questions, or let your AI use what it remembers. Get one private file that tells any AI who you are.
  • One me.md file with up to ten dated sections
  • A list of facts taken from memory, for you to check
  • A short note of what it removed for privacy
  • The two next steps, to save it and set it up
• George Orwell: Rewrite a memo, report or announcement in plain words using George Orwell’s recorded approach. Cut padding and reveal what vague labels hide.
  • Your problem worked on the way George Orwell would: their questions, their method, their push-back
  • The answer or the work, in George Orwell's voice, using their ideas by name
  • Anything that goes beyond their public record, marked
  • One suggested next step
• Kurt Vonnegut: Review plain writing or a story’s shape using Kurt Vonnegut’s recorded ideas. Cut clutter, trace changes in fortune and question the perfect plan.
  • Your problem worked on the way Kurt Vonnegut would: their questions, their method, their push-back
  • The answer or the work, in Kurt Vonnegut's voice, using their ideas by name
  • Anything that goes beyond their public record, marked
  • One suggested next step

Tasks you can use it for

• A prospect or customer sends a security questionnaire before they will sign.
• Your answers sit in policies and old questionnaires, not in one place.
• You are not sure whether a control is live or only planned.
• The same questions come back every few months and each answer is written from scratch.

Limits to check before starting

• You are the one sending questions to a vendor. Use the Vendor risk reviewer.
• You have no written policies or controls yet. Use the Compliance readiness checklist builder first to see what to build.
• You need a SOC 2 or ISO report. This prepares answers and does not certify anything. Your auditor does that.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Download the pack and give the whole folder to Claude, ChatGPT or Gemini. Pick one that can make spreadsheets if the questionnaire is a workbook.
• Attach the questionnaire, your policies and the proof you can share. Say who signs off.
• Check the evidence table first. Every yes needs a file and a date. Change any yes without proof to "no evidence yet".
• Read the draft answers. Remove anything you would not say to the customer. Send the unanswered list to the people who own those controls.
• Ask your security owner to approve the final version before you send it.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/prepare-a-vendor-security-questionnaire-response for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.