Recipes / Security questionnaire first draft: answers from your knowledge base, each with a source

Security questionnaire first draft: answers from your knowledge base, each with a source

Notion + Highspot

IntermediateAEs

Who it's for

AEs and sales engineers who get an RFP or vendor security questionnaire and want a sourced first draft before the security team reviews it. Every answer cites the page it came from, and anything without a source is marked "needs SME". Notion can be swapped for Airtable if your approved answers live in a base. Highspot is optional if your security docs are all in Notion.

What you get

First-draft answers with sources, and the items left for an SME. Sample output: every company and person in it is fictional.

Questionnaire: Larkspur Freightworks (fictional) vendor security review, 48 questions
Drafted: 39. Needs SME: 9. Nothing has been sent or saved.

| # | Question | Draft answer | Source |
|---|---|---|---|
| 3 | Is customer data encrypted at rest? | Yes. Customer data is encrypted at rest with AES-256. | Notion: "Security Overview 2026", section Encryption |
| 4 | Is data encrypted in transit? | Yes. All traffic uses TLS 1.2 or higher. | Notion: "Security Overview 2026", section Encryption |
| 11 | Do you have a current SOC 2 Type II report? | Yes. The latest report covers Jan to Jun 2026 and is shared under NDA. | Highspot: "SOC 2 summary for prospects" |
| 17 | Where is customer data hosted? | US regions only. | Notion: "Data Residency FAQ" (last edited Mar 2025, check it is current) |
| 22 | Do you support customer-managed encryption keys? | Needs SME | No page found |
| 31 | What is your RTO for a full region outage? | Needs SME | Two pages disagree: 4 hours vs 8 hours |
| 40 | Do subprocessors get annual audits? | Needs SME | No page found |

Needs SME (9): Q22, Q25, Q29, Q31, Q34, Q40, Q41, Q45, Q47
Suggested owner: Dana Okafor (security), per the "Who answers what" page in Notion.

Waiting for approval: save this draft as a new Notion page "Larkspur security questionnaire, draft 1" under Deal Desk. Not created yet.

Time and cost

Estimate About 20–40 minutes for a 60-question form, most of it checking sources and routing the gaps.

Assumptions: One questionnaire of about 50 questions, answered from a security section in Notion and a few Highspot documents.

Exact credit costs depend on your plan with each vendor. Check the tool pages before a large run.

MCP servers

Every server is confirmed in: ClaudeChatGPT

Set up in a chat app

Every server in this recipe is confirmed for Claude and ChatGPT. Connect each one, then paste the prompts below into one conversation.

Developer setup

Auth setup and mcp.json for Claude Code and Cursor
  • Notion: Sign in with OAuth in your client (run /mcp in Claude Code). Do it once interactively, and the client stores and refreshes the token.
  • Highspot: Sign in with OAuth in your client (run /mcp in Claude Code). Do it once interactively, and the client stores and refreshes the token.

Put this in .mcp.json (Claude Code, project root) or ~/.cursor/mcp.json (Cursor). Swap the example keys for your own, and don't commit real ones. Remove the // comment lines if your client requires strict JSON.

{
  "mcpServers": {
    "notion": {
      "url": "https://mcp.notion.com/mcp"
    },
    "highspot": {
      "url": "None"
    }
  }
}

Step-by-step prompts

  1. Here is the questionnaire from {company}: {questions}. Number each question and group them by topic (encryption, access control, hosting, incident response, compliance, vendors). Don't answer anything yet.
  2. Search Notion for our security and compliance pages, starting with {security_space}. For each question, find the page that answers it and quote the sentence you rely on, with the page title, section and last-edited date. If you can't find one, write "needs SME". Don't guess.
  3. Search Highspot for our security content, like the SOC 2 summary, security whitepaper or trust FAQ. Use it to fill gaps or confirm answers. List any question where Highspot and Notion disagree, and mark those "needs SME".
  4. Show me the full draft as a table: number, question, draft answer, source. Then list every "needs SME" item with who should answer it, if a Notion page names an owner.
  5. Only after I approve it, save the draft as a new Notion page called "{company} security questionnaire, draft 1" under {parent_page}. Don't edit any existing page.

Run it on a schedule (optional)

Where this goes wrong

Gotchas

Download

Get the prompts, guardrails and expected output as one Markdown file. Paste it into a Claude Project or ChatGPT project's instructions, or save it as CLAUDE.md for Claude Code.

Download security-questionnaire-draft.md