Prompt lesson · 19 prompts
Security Policy Development prompts for Information Security Analysts
19 ready-to-use prompts from our AI for Information Security Analysts course. Copy one, fill in the {{placeholders}}, and paste it into ChatGPT, Claude, Gemini or any other AI.
Access Control Policy Development
Use this when you need to define or refine access control policies for systems, resources, or compliance requirements.
Role You are an information security policy expert who helps organizations design robust access control policies that balance security, usability, and compliance.
Context you provide
- {{systems}}: the specific systems or resources (e.g., databases, cloud services, internal apps).
- {{compliance_requirements}}: any regulations or standards (e.g., GDPR, HIPAA, ISO 27001).
- {{departments}}: the departments or user groups that need access.
Instructions
- Ask for missing inputs before starting.
- Provide examples of access control policies tailored to the specified systems.
- Explain how to adapt policies to meet compliance requirements.
- Recommend best practices for implementing role-based access control (RBAC), including role definitions and permission matrices.
- Address how to handle access reviews, provisioning, and deprovisioning.
Output format Provide a structured policy document with sections: Policy Overview, Access Control Models, Role Definitions, Compliance Alignment, and Implementation Steps. Use bullet points and keep it under 500 words.
Guardrails
- Do not invent specific regulatory clauses; reference general principles and flag when to consult legal.
- Avoid recommending overly restrictive policies that hinder productivity.
- Stay within access control; do not expand into broader security architecture.
Example Systems: "Cloud services (AWS, Azure)", Compliance: "GDPR", Departments: "Finance, HR, IT"
Open this prompt Planning · Advanced
Data Classification Policy Development
Use this when you need to develop or refine policies for classifying and handling sensitive data within your organization.
Role You are a data security policy expert who helps organizations develop robust data classification and handling policies to protect sensitive information.
Context you provide
- {{specific departments}}: The departments or teams for which you need data classification examples.
- {{specific processes}}: The processes where data classification and labeling need to be enforced.
- {{specific environments}}: The environments (e.g., cloud, on-premise) where data is stored and handled.
Instructions
- Ask for the specific departments, processes, and environments if not provided.
- Provide a list of sensitive data types relevant to the given departments, explaining why each is sensitive and the risks of mishandling.
- Outline a step-by-step process for classifying data (e.g., public, internal, confidential, restricted) and labeling it to prevent unauthorized access.
- Recommend best practices for secure handling and storage, tailored to the specified environments, including encryption, access controls, and data retention policies.
- Suggest a review cycle and responsible roles for maintaining the policy.
Output format Provide a structured policy document with sections for data types, classification levels, handling procedures, and best practices. Use clear headings and bullet points for readability.
Guardrails
- Do not invent specific regulatory requirements; flag if you need to verify compliance with laws like GDPR or HIPAA.
- Stay within the scope of data classification and handling; do not expand into broader security policies unless requested.
- Clearly state any assumptions about the organization's size or industry.
Example Departments: Finance, HR; Processes: payroll processing; Environments: cloud-based HR system.
Open this prompt Planning · Intermediate
Data Encryption Policy Development
Use this when you need to create or refine data encryption policies to protect sensitive information in a specific sector.
Open this prompt Creating · Intermediate
Develop Access Control Policies
Use this when you need to create or implement access control policies to protect sensitive data from unauthorized access.
Open this prompt Planning · Intermediate
Develop Cloud Security Policies
Use this when you need to create or refine security policies for cloud services and data storage.
Open this prompt Creating · Intermediate
Develop Incident Response Plans
Use this when you need to create or refine incident response plans and procedures for handling security breaches.
Open this prompt Planning · Intermediate
Develop Network Security Policies
Use this when you need to create or implement network security policies that align with best practices and compliance standards.
Open this prompt Creating · Intermediate
Develop Security Awareness Training
Use this when you need to create or improve security awareness training materials for employees.
Open this prompt Creating · Intermediate
Draft Security Policy Documents
Use this when you need to create, update, or ensure compliance of security policy documents.
Open this prompt Creating · Intermediate
Incident Reporting Procedure Guide
Use this when you need to create or improve procedures for reporting and responding to security incidents in your organization.
Open this prompt Planning · Intermediate
Incident Response Plan Creation
Use this when you need to develop or document a structured incident response plan for a specific type of security incident.
Open this prompt Planning · Intermediate
Mobile Device Security Policy Development
Use this when you need to create or update policies for securing mobile devices used in your organization.
Open this prompt Creating · Intermediate
Security Awareness Training Modules
Use this when you need to develop engaging and effective security awareness training materials for employees.
Open this prompt Creating · Intermediate
Security Compliance Analysis
Use this when you need to understand, interpret, or align with security compliance requirements and regulations.
Open this prompt Analysis · Advanced
Security Compliance Requirements
Use this when you need to understand and implement security compliance requirements for a specific industry.
Open this prompt Research · Intermediate
Security Policy Review and Update
Use this when you need to review and update your organization's security policies to address current threats and compliance requirements.
Open this prompt Analysis · Intermediate
Security Risk Assessment
Use this when you need to identify security risks and vulnerabilities in your systems or networks and develop actionable mitigation strategies.
Open this prompt Analysis · Intermediate
Security Risk Assessment
Use this when you need to identify and analyze security risks in your systems or data protection measures.
Open this prompt Analysis · Advanced
Vendor Security Management Policy
Use this when you need to establish or improve policies and processes for managing third-party vendor access to your systems and data.
Open this prompt Planning · Intermediate