Techniques for automating/streamlining the process of responding to a security/privacy RFI/RFP as well as monitoring the security/privacy/IT compliance of an organization are disclosed. For this purpose, a variety of data sources, internal and external to the organization, are employed. A set of machine learning algorithms are also used that find the most appropriate item in the database of data sources that match any given question/item of the RFP. Based on this matching, the RFP question is answered in an automated or a semi-automated manner. The compliance of the organization against a given policy or set of controls is monitored and any observed security/privacy gaps/risk are identified. Recommendations on overcoming the gaps are further provided to the organization.