Request Specific Output Formats

Why Format Matters

Compliance work demands specific deliverables: policy documents, risk matrices, control mappings, audit checklists, evidence logs. Without format guidance, ISMS Copilot defaults to paragraph explanations—useful for learning, less useful for implementation.

Requesting explicit formats produces ready-to-use outputs: tables you can paste into spreadsheets, policy sections you can drop into templates, checklists you can print for audits. This eliminates reformatting work and accelerates from guidance to action.

Common Compliance Formats

1. Tables and Matrices

Ideal for control mappings, gap analysis, risk assessments, and asset inventories.

Example request: "Create a table mapping our HR processes to ISO 27001:2022 Annex A.6 controls, with columns for Process, Control Number, Control Name, Current State, and Gap"

Output use: Copy into spreadsheet for executive review or audit evidence.

Risk assessment example: "Generate a risk matrix for cloud infrastructure threats with columns: Asset, Threat, Likelihood (1-5), Impact (1-5), Risk Score, and Mitigation Control"

Control mapping example: "Create a table showing which SOC 2 controls overlap with ISO 27001:2022, with columns: SOC 2 Criteria, ISO 27001 Control, Description, Single Policy Possible (Y/N)"

2. Checklists

Perfect for audit preparation, implementation tracking, and evidence collection.

Example request: "Generate a SOC 2 Type II readiness checklist with categories for Policies, Access Controls, Change Management, Monitoring, and Vendor Management. Include checkbox format and evidence requirements for each item."

Output use: Print for team meetings, track in project management tools, share with auditors.

Evidence checklist example: "Create a checklist of evidence items for ISO 27001 A.8.15 (logging and monitoring) including log retention proof, monitoring alerts configuration, and incident response records"

3. Policy and Procedure Documents

Request structured sections for formal documentation.

Example request: "Draft an access control policy for ISO 27001 A.5.15-5.18 with sections for Purpose, Scope, Roles and Responsibilities, Access Request Process, Review Procedures, Termination Process, and References. Use formal policy language suitable for executive approval."

Output use: Customize with company specifics, route for approval, publish to policy repository.

Procedure example: "Create a step-by-step incident response procedure for SOC 2 CC7.3 with numbered steps, decision points, escalation criteria, and communication templates"

4. Lists (Ordered and Unordered)

Useful for implementation steps, control requirements, and tool recommendations.

Example request: "List the technical controls required for ISO 27001 A.8.24 (cryptography) in priority order for a SaaS platform, with brief implementation notes for each"

Tool recommendation example: "Provide a bulleted list of SaaS tools for SOC 2 compliance automation covering access reviews, log management, and vendor assessments, with approximate pricing"

5. Workflows and Flowcharts (Text-Based)

Describe decision trees and process flows in structured format.

Example request: "Describe the change management approval workflow for ISO 27001 A.8.32 in step-by-step format: who submits, who reviews, approval criteria, rollback triggers, and post-implementation verification"

Output use: Convert to flowchart visuals, document in process documentation, train team members.

6. Templates

Request fill-in-the-blank formats for recurring tasks.

Example request: "Create a vendor risk assessment template for SOC 2 CC9.2 with sections for Vendor Information, Data Handling, Security Controls, Compliance Certifications, Assessment Score, and Approval Decision. Include rating scales."

Output use: Save as reusable template for evaluating each vendor.

Risk treatment template example: "Generate a risk treatment plan template for ISO 27001 with fields for Risk ID, Risk Description, Treatment Option (Accept/Mitigate/Transfer/Avoid), Controls Implemented, Owner, Due Date, and Verification Method"

7. Comparison Formats

Side-by-side analysis for decision-making.

Example request: "Compare AWS KMS, HashiCorp Vault, and Google Cloud KMS for ISO 27001 A.8.24 cryptographic key management in a table with rows for Cost, Ease of Integration, Key Rotation, Audit Logging, and Compliance Certifications"

8. Evidence Logs

Structured documentation for audit trails.

Example request: "Create an evidence log format for SOC 2 CC6.1 access reviews with columns: Review Period, Reviewer Name, Systems Reviewed, Users Reviewed, Access Changes Made, Review Date, and Auditor Notes"

Format Specifications

Markdown Tables

ISMS Copilot can generate markdown tables you can copy directly into documentation tools or convert to other formats.

Example request: "Create a markdown table comparing ISO 27001:2013 vs. 2022 Annex A controls with columns: Old Control, New Control, Change Type (Renamed/Merged/New/Removed)"

Numbered vs. Bulleted Lists

Specify hierarchy for clarity:

• Numbered lists: Sequential steps, prioritized items, ranked recommendations

• Bulleted lists: Non-sequential requirements, feature lists, equal-priority items

Example: "Provide a numbered list of ISO 27001 implementation phases in chronological order, with bulleted sub-tasks under each phase"

Section Headings and Depth

For long documents, request specific heading structures.

Example request: "Draft an information security policy with main sections (H2 headings) for Purpose, Scope, Policy Statements, Roles, and Procedures. Under Policy Statements, use H3 headings for Access Control, Data Protection, and Incident Response."

Examples by Use Case

Gap Analysis

Request: "Analyze our current security controls against SOC 2 CC6-CC8 in table format with columns: Control, Requirement, Our Current State, Gap (Yes/No), Priority (High/Med/Low), Remediation Effort (Hours)"

Why this format: Executives need prioritized view; implementers need effort estimates; auditors need gap identification.

Audit Preparation

Request: "Create an ISO 27001 certification audit checklist organized by Annex A domain (A.5, A.6, A.7, A.8) with checkboxes for Policy Exists, Procedure Documented, Evidence Collected, and Tested/Verified"

Why this format: Track readiness across 93 controls, identify weak areas, delegate evidence collection tasks.

Risk Management

Request: "Generate a risk register template with columns: Risk ID, Category (Confidentiality/Integrity/Availability), Threat Source, Asset Affected, Inherent Risk Score, Controls in Place, Residual Risk Score, Treatment Decision, Owner. Include scoring guidance (1-5 scale for likelihood and impact)."

Why this format: Standardized risk scoring, clear ownership, audit trail for treatment decisions.

Policy Development

Request: "Draft a business continuity policy for ISO 27001 A.5.29 with these sections: 1) Purpose and Scope, 2) Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) by system tier, 3) Roles (BC Coordinator, Department Heads, IT), 4) Plan Activation Triggers, 5) Testing Schedule, 6) Review and Update Process. Use formal corporate policy tone."

Why this format: Structured for legal/exec review, includes decision criteria, defines measurable objectives.

Implementation Planning

Request: "Create a Gantt chart-style timeline in table format for 6-month SOC 2 implementation with columns: Month, Phase, Key Activities, Deliverables, Owner, Dependencies. Start with gap assessment in Month 1 through readiness review in Month 6."

Why this format: Visualize dependencies, assign ownership, track milestones for project management.

Tool Evaluation

Request: "Compare security awareness training platforms (KnowBe4, Proofpoint, SANS) in table format for ISO 27001 A.6.3 compliance with rows for Content Library, Phishing Simulation, Compliance Tracking, Cost per User, and Integration with Okta/Google"

Why this format: Objective comparison for procurement decisions, alignment with specific control requirements.

Combining Formats

Many queries benefit from multiple formats in sequence.

Example: "For ISO 27001 A.8.15 logging requirements: 1) Create a table of log sources (Application, AWS CloudTrail, Okta) with retention periods and monitoring tools, 2) Provide a bulleted list of log events that must trigger alerts, 3) Draft a numbered procedure for log review and incident escalation"

Output: Reference table + quick-scan list + implementation procedure in one response.

Refining Format Outputs

If initial format doesn't match needs, iterate:

• "Add a Status column to the risk matrix for tracking remediation progress"

• "Convert the bulleted list to a numbered priority ranking"

• "Expand the policy template to include a Definitions section"

• "Reformat the table to group controls by implementation difficulty instead of alphabetically"

Workspaces remember context, so refinements build on previous outputs.

When Format Isn't Specified

Without format requests, ISMS Copilot defaults to:

• Explanatory paragraphs for "how" and "what" questions

• Bulleted lists for multi-item responses

• Structured prose for policy/procedure generation

This works for learning but requires manual reformatting for deliverables. Always specify format for implementation outputs.

Export and Integration

Formatted outputs work well with:

• Spreadsheet tools: Markdown tables paste into Excel/Google Sheets

• Documentation platforms: Policies copy into Confluence, SharePoint, Notion

• Project management: Checklists import to Jira, Asana, Monday.com

• GRC platforms: Risk registers and evidence logs integrate with Vanta, Drata, Secureframe

Specify if output needs compatibility with specific tools (e.g., "in CSV-compatible format" or "as Markdown for Confluence").

Testing Format Clarity

Before sending, verify your request specifies:

1. Output type (table, list, policy, checklist, template)

2. Structure (columns/rows, section headings, numbering scheme)

3. Content per element (what information in each column/section)

4. Tone or style if applicable (formal policy language, technical procedure, executive summary)

Next Steps

Identify your next compliance deliverable and request the exact format you need. Notice how formatted outputs accelerate from AI response to implemented deliverable.

Back to Prompt Engineering Overview