Claude prompt for a security audit

Act as a senior application-security auditor. Help me prepare a security audit of [SYSTEM OR SCOPE] for [BUSINESS CONTEXT]. Use only the evidence I provide in [CURRENT CONTROLS AND EVIDENCE] and the stated assumptions in [COMPLIANCE OR RISK REQUIREMENTS]. Do not claim that a control exists, a vulnerability is present, or a test has been performed unless my inputs support it.

First, state the audit boundary: in-scope assets, data types, users, integrations, environments, and exclusions. List up to 3 clarifying questions only if a required input is missing.

Then produce:

1. A one-page audit plan organized by asset inventory, identity and access, secure configuration, application security, secrets, data protection, logging and monitoring, incident response, backups, third parties, and change management. For each area, name the evidence to inspect and the test or interview to run.
2. A risk register table with columns: finding or verification question, affected asset, realistic threat scenario, evidence status, likelihood (1-5), impact (1-5), risk score, priority, owner, recommended remediation, and validation step. Calculate risk score as likelihood × impact and show the arithmetic.
3. A 30/60/90-day remediation plan, separating quick containment from durable fixes.
4. A short executive summary that distinguishes confirmed gaps, unverified questions, and accepted risks.

Use OWASP ASVS and NIST CSF as reference structures where relevant, but map requirements to the actual scope rather than pretending compliance. Self-check before answering: flag every conclusion that relies on an assumption, and verify that every numerical score and priority follows the stated scale. This is audit preparation, not a substitute for qualified security testing or legal/compliance advice.

Assess [VENDOR NAME] for use in [INTENDED USE]. Based only on [VENDOR EVIDENCE], create a vendor-security review table covering data handling, authentication, encryption, incident notification, subprocessors, business continuity, and contract gaps. Mark every item as verified, missing, or needs clarification. Score inherent and residual risk from 1-5, show the arithmetic, and draft the 10 most important questions for the vendor. Do not infer certifications or controls that are not documented.

Create an AWS security-review runbook for [AWS ENVIRONMENT] using [KNOWN CONFIGURATION] and [DATA CLASSIFICATION]. Cover IAM, root-account controls, network exposure, encryption, logging, backups, secrets, container or serverless workloads, and account separation. For each check, state the console, CLI, or evidence source; the expected secure state; and the risk if it fails. Produce a findings template with likelihood × impact scoring. Flag checks that need read-only access or a qualified reviewer.

Design a security incident-response readiness assessment for [ORGANIZATION] and [TOP SCENARIOS], using [CURRENT PLAYBOOKS OR NOTES]. Produce a scenario-by-scenario table for detection, triage, containment, communications, legal/privacy escalation, recovery, and post-incident review. Identify missing decisions, contacts, evidence sources, and recovery time assumptions. Include a 90-minute tabletop agenda and five injects. Do not claim the organization can meet a recovery target unless the supplied evidence supports it.