Security policy drafting: how to do it with AI
Last checked 2026-10-15
IntermediateBot with human review 🛡️ Cybersecurity
Draft acceptable-use or incident response policy.
1. Bot automation level
Bot with human review Sensitive domain — outputs must be checked by someone accountable before use.
2. Before you hand it to the bot
- Gather inputs: files, data samples, links and any templates.
- Access: make sure you can use the chosen bot/plan (see limits below).
- Context: tell the bot audience, purpose, constraints and examples of good output.
- Privacy check: remove personal, confidential or regulated data unless your plan/workspace is approved for it.
- Success criteria: write down what 'done' looks like (length, format, tests passing, fields filled).
3. Copy-paste prompts
Main prompt
Draft an incident response policy for a 50-person company.
Beginner-friendly
Draft an incident response policy for a 50-person company. I'm new to this: explain each step in plain words and ask me for anything you need before starting.
Check-your-work
Draft an incident response policy for a 50-person company. When you finish, list any assumptions you made, anything you're unsure about, and what I should double-check before using the result.
Free tiers that can handle this (verified): ChatGPT (incl. Work & Codex), Claude (incl. Claude Code), Google Gemini, Mistral Le Chat. Others: check plan.
4. Step-by-step
- Open a bot from the list below (use a Project/Canvas/Artifact if available to keep context).
- Upload or paste your inputs and the prompt below.
- Ask the bot to state assumptions and show its work (sources, formulas or code).
- Review the first output; give specific corrections in a follow-up.
- Verify key facts, numbers or behaviour against your source data.
- Export or copy the final version and note what you'd reuse next time.
5. Which bots and plans can do it
| Tool | What's different here | Plan limits | Source |
|---|---|---|---|
| ChatGPT (incl. Work & Codex) | — | Free tier has limited deep research, Codex and Work; scheduled tasks need Go or higher (per chatgpt.com/pricing). | help.openai.com/en/articles/20001275-chatgpt-work-and-codex |
| Claude (incl. Claude Code) | — | Claude Code and Research need Pro or higher; computer use is Pro/Max only (research preview). | code.claude.com/docs/en/desktop |
| Google Gemini | — | Free tier includes Deep Research, Canvas, Gems; video generation needs AI Plus or higher. | gemini.google/overview/deep-research/ |
| Microsoft Copilot | — | Copilot in Word/Excel/PowerPoint/Outlook needs an eligible Microsoft 365 plan. | www.microsoft.com/en-us/microsoft-copilot/for-individuals/features |
| Mistral Le Chat | — | Free tier has limited messages, searches and coding sessions; Pro raises limits. | mistral.ai/pricing |
Free or paid?
- ChatGPT (incl. Work & Codex): Free plan: yes. unlimited text chats; limited uploads, images, voice, deep research and Codex. Paid: price not verified, so check the official site. Its free tier can handle this task.
- Claude (incl. Claude Code): Free plan: yes. chat, web search, files & code execution, Artifacts, connectors. Claude Code and Research need Pro. Paid: the lowest price we could verify on the official pricing page is $20/month (other plans may exist). Its free tier can handle this task.
- Google Gemini: Free plan: yes. Flash-Lite model, image generation, Deep Research, Live, Canvas, Gems. Video needs AI Plus or higher. Paid: the lowest price we could verify on the official pricing page is $99.99/month (other plans may exist). Its free tier can handle this task.
- Microsoft Copilot: Free: not verified, so check the official site. Paid: the lowest price we could verify on the official pricing page is $23.5/month (other plans may exist). For this task, check the plan.
- Mistral Le Chat: Free plan: yes. limited messages, searches, coding sessions and basic images. Paid: the lowest price we could verify on the official pricing page is $14.99/month (other plans may exist). Its free tier can handle this task.
6. Risks and what to double-check
- Verify against official advisories; don't paste secrets or live credentials.
- AI can hallucinate facts — verify anything that matters.
- Don't share secrets or other people's personal data.