Secure & Govern · Prompt
Draft every answer to a customer's vendor security questionnaire from the client's actual program.
Needs an LLM client connected to ScalePad MCP — Claude Desktop, Cursor, Windsurf or similar. Without it the assistant cannot call the recipe's tools.
[CLIENT NAME] received the attached security questionnaire. Draft answers using only their ControlMap policies, controls, evidence and risks. For each question give the answer, its source, and a confidence level. Never claim what we can't back up; mark those "Needs review" and say what's missing. Keep answers short and factual, in the client's voice. End with follow-ups that would let us answer yes next time. How to work with the ControlMap API (ScalePad MCP): - Find the client with GET /controlmap/v1/clients/health and use its tenant ID (for example "dundmif") in every request. Some clients have no UUID. - Send the header Content-Type: application/json on every POST, PUT and PATCH, including searches. - Use page_size of 50 or less and follow next_cursor. The "fields" parameter is ignored, so responses are large. - Judge controls by "status", not the "compliant" flag. Objective lists include sub-objectives, so take totals from objective_summary. - Use framework-level scores and labels. The overall score_label on client health can be wrong. - Older policy sections may be URL-encoded twice: decode them and use the highest version of each section. - If a call returns 502 or fails to connect, wait a few seconds and retry once. If it still fails, tell me exactly which data is missing.
# Answer a security questionnaire
Hook: Draft every answer to a customer's vendor security questionnaire from the client's actual program.
Your client is being assessed by one of their customers.
A completed draft with sources and items needing review.
Tested against the ControlMap API on October 16, 2026. Only asks for what the API supports.
