Cybersecurity & Risk5.0 · 0 ratings

Third Party Vendor Security Assessment

Evaluates a vendor's security posture from questionnaire and attestation evidence into a go/no-go risk rating.

Role-BasedStructured-OutputStep-by-Step

Prompt

ROLE: You are a third-party risk management (TPRM) analyst assessing a vendor before onboarding.

CONTEXT:
- Vendor and service: [VENDOR_NAME_AND_WHAT_THEY_PROVIDE]
- Data they will access/process: [DATA_TYPES_AND_VOLUME]
- Integration depth: [API_SSO_ON_PREM_ACCESS]
- Evidence provided: [SOC2_ISO_QUESTIONNAIRE_RESPONSES_PASTE]
- Business criticality: [HOW_ESSENTIAL_IS_THIS_VENDOR]

TASK:
1. Classify the inherent risk tier based on data sensitivity and access (Critical/High/Medium/Low) and justify it.
2. Review the evidence for coverage gaps: scope of SOC 2, exceptions in the report, certificate validity dates, subservice organizations.
3. Evaluate key control domains: access management, encryption, incident response, BCP/DR, breach notification SLAs, subprocessor governance.
4. Identify red flags and missing evidence; list the follow-up questions needed.
5. Recommend contractual safeguards (right to audit, breach notification window, data-deletion on exit, cyber-insurance minimums).

OUTPUT FORMAT:
- Inherent risk tier + rationale
- Control domain scorecard (Adequate / Gap / Unknown)
- Red flags & open questions
- Recommended contract clauses
- Decision: Approve / Approve with conditions / Reject — with conditions enumerated

CONSTRAINTS: Distinguish 'no evidence' from 'evidence of a weakness.' Do not assume controls exist without attestation. Calibrate scrutiny to the inherent risk tier — don't over-assess a low-risk vendor.

How to use this prompt

  1. 1

    Copy the prompt above and paste it into ChatGPT, Claude, or Gemini — or open it in the visual Studio to edit each part on a canvas and run it with your own key.

  2. 2

    Replace any bracketed placeholders with your specifics. The more concrete your context and constraints, the sharper the result — see the 5-part prompt structure.

  3. 3

    Run it, then refine. Ask the model to critique and improve its own answer with self-critique prompting.

Techniques in this prompt

Role-Based

Assigns the model an expert persona so it adopts the right vocabulary, depth, and standards for the task.

Learn this technique
Structured Output

Pins the response to a defined structure so it drops straight into your workflow.

Learn this technique
Step-by-Step

Forces explicit intermediate reasoning instead of jumping to a conclusion, which improves accuracy on hard tasks.

Learn this technique

Recommended models

claudegpt-4ogemini

Build on this prompt

Open it in the visual Studio to wire it into a full workflow with your own API key — or learn the craft behind prompts like this.

Open in Studio How to prompt AI correctly

More in Cybersecurity & Risk

STRIDE Threat Model For A New Service

Builds a structured STRIDE threat model for a system with trust boundaries, ranked threats, and concrete mitigations.

Read prompt

Security Incident Postmortem Author

Drafts a blameless post-incident review with timeline, root cause, and corrective actions ready for leadership.

Read prompt

CVE Triage And Prioritization Analyst

Triages a list of CVEs by exploitability and business context to produce an actionable patch priority queue.

Read prompt

Phishing Email Forensic Examiner

Analyzes a suspicious email's headers, URLs, and payload to classify intent and recommend SOC response.

Read prompt