# Security questionnaire first draft: answers from your knowledge base, each with a source

Source: https://mcpforgtm.com/recipes/security-questionnaire-draft (StackMCP, independent directory of official MCP servers)

## Goal

AEs and sales engineers who get an RFP or vendor security questionnaire and want a sourced first draft before the security team reviews it. Every answer cites the page it came from, and anything without a source is marked "needs SME". Notion can be swapped for Airtable if your approved answers live in a base. Highspot is optional if your security docs are all in Notion.

## Connected tools

- Notion: https://mcp.notion.com/mcp (setup: https://mcpforgtm.com/tools/notion)
- Highspot: see vendor docs (setup: https://mcpforgtm.com/tools/highspot)

## Guardrails

- Never invent a security claim. Answer only from a page you can name and quote.
- Anything without a source, or where sources disagree, is "needs SME". Don't guess and don't soften it.
- Cite the page title and section for every answer.
- Read only by default. Create a Notion page only after I approve it, and never edit existing security pages.
- Don't send anything to the customer. This is a first draft for internal review.

## Steps

1. Here is the questionnaire from {company}: {questions}. Number each question and group them by topic (encryption, access control, hosting, incident response, compliance, vendors). Don't answer anything yet.
2. Search Notion for our security and compliance pages, starting with {security_space}. For each question, find the page that answers it and quote the sentence you rely on, with the page title, section and last-edited date. If you can't find one, write "needs SME". Don't guess.
3. Search Highspot for our security content, like the SOC 2 summary, security whitepaper or trust FAQ. Use it to fill gaps or confirm answers. List any question where Highspot and Notion disagree, and mark those "needs SME".
4. Show me the full draft as a table: number, question, draft answer, source. Then list every "needs SME" item with who should answer it, if a Notion page names an owner.
5. Only after I approve it, save the draft as a new Notion page called "{company} security questionnaire, draft 1" under {parent_page}. Don't edit any existing page.

## Expected output

First-draft answers with sources, and the items left for an SME. Example (all names fictional):

```
Questionnaire: Larkspur Freightworks (fictional) vendor security review, 48 questions
Drafted: 39. Needs SME: 9. Nothing has been sent or saved.

| # | Question | Draft answer | Source |
|---|---|---|---|
| 3 | Is customer data encrypted at rest? | Yes. Customer data is encrypted at rest with AES-256. | Notion: "Security Overview 2026", section Encryption |
| 4 | Is data encrypted in transit? | Yes. All traffic uses TLS 1.2 or higher. | Notion: "Security Overview 2026", section Encryption |
| 11 | Do you have a current SOC 2 Type II report? | Yes. The latest report covers Jan to Jun 2026 and is shared under NDA. | Highspot: "SOC 2 summary for prospects" |
| 17 | Where is customer data hosted? | US regions only. | Notion: "Data Residency FAQ" (last edited Mar 2025, check it is current) |
| 22 | Do you support customer-managed encryption keys? | Needs SME | No page found |
| 31 | What is your RTO for a full region outage? | Needs SME | Two pages disagree: 4 hours vs 8 hours |
| 40 | Do subprocessors get annual audits? | Needs SME | No page found |

Needs SME (9): Q22, Q25, Q29, Q31, Q34, Q40, Q41, Q45, Q47
Suggested owner: Dana Okafor (security), per the "Who answers what" page in Notion.

Waiting for approval: save this draft as a new Notion page "Larkspur security questionnaire, draft 1" under Deal Desk. Not created yet.
```

## Watch for

- An invented security claim: The model may answer from general knowledge when your pages are silent, and the answer will sound right. Every row must have a page title and section. Treat any row without one as "needs SME" and spot-check five sourced rows against the page itself.
- Out-of-date pages: A two-year-old policy page can still rank first in search. Ask for each source's last-edited date, and send anything older than your last audit to an SME.
- Sources that disagree: Notion and Highspot may hold different versions of the same fact, like a retention period or RTO. Ask it to list every question where two sources give different answers, and mark those "needs SME" instead of picking one.
- Stretching a partial answer: A page that says "we encrypt backups" does not answer "do you support customer-managed keys". Have it quote the sentence it relied on for each answer, and downgrade any answer where the quote doesn't cover the whole question.