01 Find a record
Find the record you need, then follow its linked assets, risks and evidence.
“Find the risks linked to [system].”
A PRACTICAL GUIDE
Put your records to work.
Practical prompts for finding, reviewing and updating records.
Read-only by default. Your permissions apply.
01
Your workspace, in the conversation.
MCP connects your AI client to the CSFaaS records you are allowed to use. Ask for what you need in your own words.
CSFaaS MCPThe workspace connectionYour workspacePermitted records & evidence
02 Compare the evidence
Ask your AI client what the available evidence supports and what is still missing.
“Which parts of this control lack evidence?”
03 Request a change
Propose a specific update or comment. Saving requires write access for your workspace and connection.
“Add this comment to [record].”
An AI review is an analysis to check. It does not itself certify compliance, change an assessment or save a record.
02
Work across your security program.
Start with a record, a business question or an upcoming review. Follow the existing connections to build a fuller picture.
Risks & assessments
Understand exposure, challenge an assessment and clarify the scope of a risk demand.
What’s included
- Recorded scenarios, scores and rating scales
- Affected assets, owners and treatment plans
- Draft context and risk proposals for review
Remediation & follow-up
See what is overdue and whether the evidence supports the planned action.
What’s included
- Plan status, owners and due-date history
- Evidence reviews and proposed next steps
- Supported updates and workflow actions with write access
Frameworks & controls
Explore your recorded posture and find where implementation or assessment work is missing.
What’s included
- Framework elements and recorded maturity
- Control implementation and available evidence
- Existing links between requirements and policy controls
Policies & governance
Read the actual policy content and review it in the context of your organization.
What’s included
- Policy sections, controls and version information
- Framework relationships and responsibilities
- Suggested wording and gaps to discuss with owners
Audits & findings
Prepare reviews with the questions, responses and supporting proof in one conversation.
What’s included
- Audit scope, questions and clarifications
- Responses, findings and recommendations
- Evidence-based preparation and response drafts
Evidence & documents
Go beyond the attachment name: read supported documents and assess what they demonstrate.
What’s included
- Evidence records and their linked context
- PDF text and supported images; scanned pages when available
- Evidence comparisons and supported URL attachments
Assets & third parties
Trace recorded dependencies and find gaps in your asset and supplier risk coverage.
What’s included
- System and third-party records
- Linked assets, suppliers and risks
- Supported record creation and relationship updates
Reviews & questionnaires
Prepare follow-ups using review schedules, available submissions and business context.
What’s included
- Tracked, untracked and exempted reviews
- Questionnaire questions and visible responses
- Business objectives, stakeholders and scope
Workspace & activity
Catch up on changes and build a focused list of work that needs your attention.
What’s included
- Available activity, comments and updates
- Your inbox, followed items and ownership
- Recorded metrics and plain-language briefings
Team prompts
Reuse your team’s review instructions with the context of the task in front of you.
What’s included
- Discover prompts available in your workspace
- Use a current validated version or an available chosen version
- Add context for a particular record, audience or review
Follow the contextAn example of linked work
SystemRiskRemediationEvidence
03
A good question is a great start.
50 copyable examples. Choose an area, find a task and make the prompt your own.
Replace [bracketed text] with your own names or references, then paste into your connected AI client. These examples do not run on this page.
50 examples to make your own
Start with what matters
What needs my attention in this workspace today? Focus on work I own or follow, overdue items and unread updates. Give me the ten most useful next actions with their record references.
What to expect
A prioritized list based on the records and updates visible to you.
Understand the biggest risks
Show the highest-priority open risks in my workspace using its current risk scores and rating scale. Include the affected assets, owners and remediation status where available.
What to expect
A risk shortlist using your workspace’s own scores and labels.
Unblock overdue work
List overdue remediation plans visible to me. Include their owners, due dates, linked risks and any recorded explanation for a delay. Prioritize the plans connected to the most significant risks.
What to expect
A follow-up list based on existing plans and their recorded context.
Find gaps in a framework
Summarize the recorded posture and gaps for [framework name] in our workspace. Distinguish assessed weaknesses from items with no assessment and respect Not Applicable items.
What to expect
A framework overview that preserves the meaning of missing assessments.
Improve a policy
Review [policy name] against our business context and its linked controls and framework requirements. Identify vague statements, missing responsibilities and inconsistencies. Draft suggested changes without saving them.
What to expect
A policy critique and proposed wording grounded in the workspace.
Prepare for an audit
Help me prepare for [audit name]. Review its scope, visible framework elements, questions, responses and evidence. Give me a checklist of gaps to address before the next review.
What to expect
An audit preparation checklist grounded in the audit’s records.
Find the supporting material
Find the evidence attached to [record name or reference]. List its names, types and recorded status, and explain which documents are most relevant to [review question].
What to expect
An index of available evidence linked to a specific record.
Find assets without risk coverage
Which assets and third parties visible to me have no recorded risk assessment? List them separately with their names and owners where available. Do not treat the absence of an assessment as a risk score.
What to expect
A coverage gap list for the visible asset inventory.
Plan upcoming reviews
Review the visible periodic review items. Identify overdue reviews, items without a schedule and recorded exemptions. Keep these groups separate and include owners where available.
What to expect
A review planning list that respects recorded exemptions.
Find your team’s playbooks
Show the saved prompts available in my CSFaaS workspace. Summarize what each is for and help me choose one for [task]. Do not run a prompt yet.
What to expect
A shortlist of reusable prompts that your access allows you to see.
Catch up on the week
Summarize changes in my workspace over the last seven days. Group them by area, name the people involved where available, and highlight changes that need a decision.
What to expect
A concise activity digest, limited to the available history.
Challenge an assessment
Review [risk name or reference] for clarity, completeness and consistency. Check its scenario, likelihood, impact, controls and remediation plans against our workspace’s scale. Separate recorded facts from your suggestions.
What to expect
A structured critique of an existing assessment.
Review proof of completion
Review the evidence attached to [remediation name or reference]. Does it demonstrate that the required action was implemented? Cite supporting evidence and explain what is missing. Do not mark the plan complete.
What to expect
An evidence-based recommendation for a human completion decision.
Prepare a control review
Review [control name or reference] and its available implementation information, owners and evidence. Explain what is documented, what is unclear and what a reviewer should ask next.
What to expect
A control review supported by the visible implementation record.
Make a policy easier to understand
Explain [policy name] for a new team member. Summarize the responsibilities and expected behavior in plain language, preserving the policy’s meaning and linking back to the relevant sections where possible.
What to expect
An accessible summary of the visible policy content.
Check whether an answer is supported
For [question reference] in [audit name], review the question, responses, clarifications and available evidence. Explain what the evidence supports and which parts still need a better answer.
What to expect
A focused review of an audit question and its supporting material.
Read a document with a purpose
Read [evidence name] linked to [record name]. Summarize the sections relevant to [question], cite pages where available, and clearly identify any parts you could not read.
What to expect
A focused document summary with reading limitations made explicit.
Prepare a supplier review
Prepare a review brief for [third-party name]. Include its recorded business context, linked assets, risk exposure and available supporting evidence. End with questions for the supplier owner.
What to expect
A supplier briefing based on existing records.
Summarize a questionnaire
Summarize the available responses to [questionnaire name]. Highlight unanswered questions, ambiguous answers and points needing follow-up. Do not infer answers from silence.
What to expect
A response summary with incomplete information clearly marked.
Use an approved team prompt
Run the current validated version of [saved prompt name or reference] for [record or task]. Use this additional context: [context]. Keep proposed changes in the conversation and do not save anything.
What to expect
A review using the selected validated prompt, with your context.
Prepare a leadership brief
Prepare a short security and compliance briefing for our leadership team using the current workspace data. Lead with business impact, use the recorded metrics, and end with three decisions or next steps.
What to expect
A draft briefing grounded in current records, with gaps called out.
Clarify the assessment scope
Read [risk demand name or reference] and its available supporting evidence. Draft a clearer context, current situation, target situation, scope and list of open questions. Keep the draft in this conversation.
What to expect
A proposed assessment context that you can review before saving.
Understand a slipping deadline
Explain how the due date for [remediation name or reference] has changed. Summarize the recorded reasons and identify questions to ask its owner.
What to expect
A timeline of recorded deadline changes and justifications.
Choose the next improvements
For [framework name], propose five improvements based on the recorded gaps and available supporting context. Explain your prioritization. Keep the official maturity and coverage figures unchanged.
What to expect
A proposed improvement shortlist, separate from official metrics.
Trace a policy’s coverage
Show how [policy name] connects to controls and framework requirements. Identify visible sections without supporting links, without treating a missing link as proof of noncompliance.
What to expect
A relationship-based coverage review.
Brief the team on findings
Summarize the findings and related recommendations in [audit name]. Include recorded owners, priorities and follow-up status where available. Highlight unresolved items.
What to expect
A concise overview of the visible findings and follow-up work.
Check for conflicting evidence
Compare [first evidence name] and [second evidence name] linked to [record name]. Highlight differences in scope, dates and claims that matter for our review. Do not decide that either document is authoritative without support.
What to expect
A comparison of accessible documents and their inconsistencies.
Understand a system’s exposure
Explain the recorded context for [system name], its linked third parties and associated risks. Identify dependencies that matter for our review without inventing relationships.
What to expect
A map of recorded relationships around the selected system.
Compare available submissions
Compare the visible submissions for [form name]. Identify recurring gaps and meaningful differences in responses. Say which submissions you reviewed and avoid drawing conclusions about missing responses.
What to expect
A comparison scoped to the submissions actually available.
Use a specific prompt version
Find [saved prompt name or reference] and confirm that version [number] is available. Run that version for [task], clearly stating which version you used. Do not save changes to workspace records.
What to expect
A review using an explicitly selected available prompt version.
Check your starting point
Before we begin, confirm which CSFaaS workspace I am connected to and summarize the access available to this connection. Do not make any changes.
What to expect
A clear statement of the connected workspace and available access.
Explore potential risk scenarios
Using [risk demand name or reference] and its supporting documents, propose five risk scenarios to investigate. Explain each cause, business consequence and possible treatment. Clearly label these as proposals, not recorded assessments.
What to expect
A set of draft scenarios, without adding risks or changing scores.
Prepare a treatment plan
For [risk name or reference], draft a practical remediation plan. Include an objective, proposed steps, an owner to confirm and the evidence needed to demonstrate completion. Do not save it yet.
What to expect
A treatment proposal in the conversation, not a saved plan.
Locate implementation work
Find controls recorded as not implemented. Group them by their linked policies where available and show their owners. Flag missing information instead of assuming why they are incomplete.
What to expect
A list of recorded implementation gaps.
Review policy versions
Show the available versions of [policy name]. Summarize what can be established from the visible version information, and say if you cannot access enough content to compare the wording.
What to expect
A version overview with the limits of comparison stated clearly.
Prepare an action update
Read [action reference] from [audit name] and its related context. Draft an update explaining progress, outstanding work and the evidence still needed. Keep it as a draft.
What to expect
A proposed action update for a reviewer to check.
Plan the missing evidence
Review the evidence for [control or remediation name]. What additional proof would help demonstrate implementation? Separate evidence already present from documents or checks you are recommending.
What to expect
A practical evidence request list, clearly labeled as a proposal.
Record a supplier relationship
Find [system name] and [third-party name]. Show me the exact matching records and whether a relationship already exists. Ask for my approval before linking them.
What to expect
A confirmed relationship between an existing system and third party.
Connect a review to the business
Summarize our recorded business context for a review of [system, supplier or policy]. Highlight relevant objectives, stakeholders and scope, and list the business information still missing.
What to expect
A business context brief for the selected review.
Make a repeatable briefing
Help me draft a reusable prompt for a weekly security briefing. It should use workspace records, preserve official metrics, distinguish facts from recommendations and ask for five short bullets. Keep the prompt as a draft here.
What to expect
A reusable prompt draft for your team to review.
Find ownership gaps
Review ownership coverage in my workspace. Identify visible items without an assigned owner and suggest which gaps I should investigate first. Do not assign anyone.
What to expect
An ownership review without changing assignments.
Record a review note
Read [risk name or reference]. Draft a short comment summarizing our agreed treatment decision and the remaining uncertainty. Show me the exact comment and ask for my approval before posting it.
What to expect
A reviewed comment added to the selected risk after you approve.
Update an agreed deadline
Read [remediation name or reference]. Propose changing its due date to [date] with the justification [reason]. Show the current and proposed values, ask for my approval, then apply only this change and confirm the result.
What to expect
A scoped deadline update, if your access and the workflow allow it.
Connect a control to a requirement
Find [policy control name] and [framework requirement name] in this workspace. Confirm the exact records and check whether they are already linked. Show me the proposed relationship and ask before creating it.
What to expect
An approved link between existing records, where that relationship is supported.
Capture a policy decision
Read [policy name] and draft a comment recording [agreed decision]. Show me the text and the policy it will be posted to. Ask for my approval before adding it.
What to expect
An approved decision note on the selected policy.
Draft a clearer audit response
Draft a response to [question reference] in [audit name] using only the visible workspace records and evidence. Identify the sources for each claim and mark anything that requires confirmation. Do not submit the response.
What to expect
A source-based response draft, not a submitted audit answer.
Attach a reference
Find [record name or reference]. Prepare to attach [document URL] as link evidence named [evidence title]. Confirm the target and ask for my approval before adding the link. Do not upload a file.
What to expect
A named evidence link attached to the selected supported record.
Add a system record
Help me create a system named [system name] with the description [description]. Check for an existing match, ask me for any required information, and show the proposed record before saving it with my approval.
What to expect
A new system record after required information and approval are supplied.
Draft follow-up questions
Using [questionnaire or review name], draft a short list of follow-up questions for the owner. Tie each question to a specific missing or unclear response. Do not send messages or update records.
What to expect
A draft follow-up list for you to review and share.
Turn a review into next steps
Using the review we just completed, create a checklist of follow-up actions. For each action, include the supporting record, why it matters and who should confirm ownership. Do not create tasks or save changes.
What to expect
A proposed follow-up checklist grounded in the current conversation.
Showing 8 of 50
04
Go further, one step at a time.
Keep the same conversation open. Use each answer to shape the next question, and check the sources along the way.
Build context first, challenge the assessment, then prepare a useful handoff.
- 1
Get the context
Start with the actual record and its relationships.
Read [risk name or reference]. Summarize its scenario, affected assets, assigned owners, controls and remediation plans using the available records.
- 2
Review the analysis
Check coherence against your own risk scale.
Review this risk assessment against our workspace’s rating scale and available evidence. Identify unclear assumptions, inconsistencies and missing information. Keep recommendations separate from recorded facts.
- 3
Prepare the decision
Turn the review into something an owner can act on.
Turn this review into a short owner briefing: what is recorded, what remains uncertain and the next three proposed actions. Do not change the risk or its scores.
- 1
Orient the review
Know which audit and requirements you are working with.
Read [audit name]. Summarize its scope, framework context, recorded status and visible open questions. Identify which supporting information is available.
- 2
Inspect the support
Read the evidence behind the responses.
Review the available responses and evidence for [question reference] in this audit. Explain which parts of the question are supported and which need clarification, citing evidence where possible.
- 3
Plan the preparation
Separate existing proof from evidence still needed.
Build an audit preparation checklist from what we reviewed. For each gap, include the question or record, missing proof and the owner if one is recorded. Keep it as a proposed checklist.
- 1
Understand the relationship
Resolve the supplier and its linked assets.
Find [third-party name] in our workspace. Summarize its recorded role, owner and linked assets. If there are multiple matches, ask me which one to use.
- 2
Read the risk picture
Use recorded exposure and evidence, without filling gaps with assumptions.
Review this third party’s linked risks and available supporting evidence. Explain the recorded exposure and identify any missing assessment context.
- 3
Prepare the conversation
Give the owner a concise, grounded set of questions.
Prepare a one-page supplier review brief with the business context, recorded risks, evidence gaps and five questions for the owner. Do not send it or change records.
- 1
Read the current record
Confirm the right target before discussing a change.
Read [remediation name or reference]. Show its current due date and recorded context. Confirm that this connection is allowed to change the due date. Do not save anything.
- 2
Review the proposal
Ask for a precise before-and-after.
Prepare a change to the due date: [new date], with justification [reason]. Show the current value, proposed value and exact target. Wait for my approval before saving.
- 3
Approve and verify
Send this only after you have reviewed the proposal.
I approve the due-date change just shown for this remediation. Apply only that change, then read back and confirm the saved due date and record reference. Report any failure or uncertainty plainly.
05
Give your question a little structure.
You do not need technical syntax. A clear target, a task and an expected output are usually enough.
01 / TARGETWhat are we reviewing?
A record name, reference or scope.
02 / TASKWhat do you need?
Find, compare, explain or propose.
03 / CONTEXTWhat should inform it?
Your records, evidence and constraints.
04 / OUTPUTWhat would be useful?
A table, checklist or short briefing.
PUT IT TOGETHER
Review [policy name] against our recorded business context and linked controls. Use the available policy content and evidence, identify missing information, and return a table of observations, supporting sources and proposed improvements. Keep all changes as a draft in this conversation.
Name the record. Use the name or reference you see in CSFaaS. If several records match, ask the client to clarify.
Ask for sources. Request record references and evidence pages where available, and separate missing information from findings.
Preserve the recorded numbers. Ask for CSFaaS metrics and your workspace’s rating scale, with suggestions clearly labeled.
Be explicit about changes. “Draft it here” and “save this update” are different requests. Ask to review the proposal before saving.
06
A clear scope. A few useful boundaries.
Available work depends on your permissions, enabled workspace features and the records you can access.
Access follows your connection
MCP is included with every workspace: owners and Account Managers can connect straight away, and they choose which other members may connect in Settings → API & MCP. A connection is scoped to one workspace and the roles you authorize; it does not reveal records outside that access.
Saving needs write access
Read-only connections can retrieve data for analysis. Changes also need a connection authorized to write and the workspace write setting. Supported workflow rules still apply.
Evidence has practical limits
Supported PDFs and images can be read. Scans depend on available page images and your client’s image support. Ask for a narrower page range on long documents. An inaccessible document is not proof of anything.
Links and files are different
You can request a supported evidence URL attachment with write access. Upload files through CSFaaS. A link alone does not mean your client can read the document behind it.
Reviews support your judgment
AI can help explain, compare and draft. Review its sources and conclusions before using them in an assessment or a decision. No results can mean no matching records within your access.
Changes have a real effect
Supported writes save to your workspace; some views may need a refresh. Check the reported result. Deletion over MCP is deliberately disabled.