Start with the real job
Build a vendor security review covering data, access, hosting, subprocessors, controls, compliance, incidents, gaps, risks, and follow-ups. Supply source material and citation links, the question you want to answer, data definitions and known limitations and identify anything the Agent should ask about first.