When my oldest was two, he loved the Wiggles.
If you haven’t heard of them, the Wiggles are an Australian children’s music group that became one of the most successful kids’ acts in the world. Think brightly colored skivvies, catchy songs (okay, for a two-year-old) like “Hot Potato” and “Fruit Salad,” and decades of TV shows and live tours.
Our little guy would dance around the family room singing hot potato, hot potato. We even took him to a live concert where he met Jeff Wiggle (probably not his real name), the original purple Wiggle!
By the time my daughter was two, three of the four original Wiggles had already retired (to do what, I have no idea), and there were new cast members. She was less enamored than her big brother with the Wiggles overall, but she loved Emma, the girl Wiggle.
Now, ten-plus years later, our kids are 15 and 13. The other day, the Wiggles came up in conversation at home.
To the shock of Mrs. Black and me, neither one of them had any memory of the group. I showed them a picture, but they still had no idea what we were talking about.
Finally, I played Hot Potato and Fruit Salad on the television. Still nothing.
Nothing Stays the Same
To Rachel and me, the Wiggles were “just yesterday.” To my kids, and even though the Wiggles were once a big part of their lives, they are ancient history — wiped from memory!
I suppose this is mostly positive news. A 15-year-old still dancing to Hot Potato might suggest the need for some kind of musical intervention. But either way, it’s a good example of how over the course of several years, things can change dramatically.
The same is true in cyber security, except here, time moves much faster… significant changes can happen in a matter of months.
For example, I’m sure you remember this (amazing) newsletter from the summer of 2024.
In it, I argued that mid-sized companies should build a “golden questionnaire” — a single, continually updated, master set of answers to the security questions customers typically ask.
These questions can range from a few pages to literally hundreds, and by doing this work ahead of time, you can both streamline the process and improve the outcome.
Everything I wrote in that newsletter is still valid. But there’s one big difference…
Back then, I dedicated just one paragraph to the role AI could play in developing a golden questionnaire. Today, it should be your primary tool in the process.
Put Your Golden Questionnaire Into a Claude Project
A Claude Project is a workspace with its own set of documents and standing instructions. Every conversation in the project draws on those documents.
So, instead of hunting through old spreadsheets for last year’s answer about encryption at rest, you paste in the new questionnaire and Claude drafts answers from your approved material.
Here’s how to do it right…
#1. Use Claude Team or Enterprise.
Your security program details are sensitive; they describe exactly how you defend your company. So they need to be safeguarded — do not use a personal account.
The Team and Enterprise plans are business plans. Your data is not used to train models by default, admins control who has access, and you can share the project with the people who need it.
That means sales, customer success, and junior staff can use the project without pulling in a senior executive every time a questionnaire arrives. (That was the whole point of the golden questionnaire in the first place.)
#2. Load more than the questionnaire.
The golden questionnaire is the core. But customer requests tend to uncover additional, unanticipated questions. By giving Claude the rest of your security program, it will have more to draw from. That includes:
- Your information security policy and supporting policies
- Your incident response and business continuity plans
- Your SOC 2 report or ISO 27001 certificate
- Your most recent penetration test summary
- Your list of subprocessors and key vendors
- A high-level architecture and data flow description
- Past questionnaires your experts have already reviewed and approved
#3. Write clear project instructions.
Tell Claude how to behave. For example:
- Answer only from the documents in this project.
- If the answer isn’t in the documents, say so. Flag it for expert review and don’t guess.
- Never commit to future features or roadmap items.
- Note which document each answer came from.
That last one is especially important. When your reviewer can see where an answer came from, checking it goes much faster.
#4. Keep a human in the loop.
The rules from two years ago still apply: Tell the truth, have your experts review the answers, get leadership approval for any commitments.
Yes, AI makes the first draft fast. But it doesn’t make the final draft accurate. That’s still your job.
#5. Build a real refresh process.
This is where most companies fall down.
A golden questionnaire in a Claude Project is only as good as what’s in it. If the documents are stale, Claude will confidently give your customers stale answers. Fast.
As with the Wiggles, if your project still thinks Jeff is the purple Wiggle (sorry, but unlike my kids, I still remember the details), every answer it gives will be ten years out of date.
A good refresh process includes:
- One named owner. Not “the security team.” A person.
- A quarterly review. Put it on the calendar.
- Event-driven updates. A new product, a new major tool, a new audit report, a policy change, a security incident… any one of these should trigger an update right away.
- Replace, don’t pile on. When you upload a new policy, delete the old one. Two conflicting versions confuse Claude just as much as they confuse people.
- Date every document. Make obvious what’s current.
- Close the loop. When a questionnaire asks something new and your expert writes the answer, add that answer to the golden questionnaire. Every questionnaire you complete makes the next one easier.
Of course, you could just buy a purpose-built system specifically made for creating and maintaining this type of document. And in some cases, that might be fine.
But if you are already paying for Claude, this is an opportunity to create a custom version for your business while improving your fluency with the tool in the process.
Change is Constant
Just as my kids don’t remember the Wiggles, your customers won’t remember how you answered their questionnaire. But they will remember if an answer was wrong.
Claude can help ensure your golden questionnaire stays as current and useful as possible.
Until next time, hot potato, hot potato… (Oh alright, here is the video.)
