{"id":"proc-vendor-security-qa-not-stated","audience":"it","category":"operations-work","track":"operations","technique":"grounding","level":"intermediate","title":"Answer four vendor risk questions only from the vendor's summary","free":false,"task":"Write a prompt for exactly four question-and-answer pairs, each a line starting \"Q:\" then a line starting \"A:\". The questions are fixed: where is our data stored, how fast will they tell us about a breach, who are their subcontractors, and what insurance do they carry. Answer only from the summary. If it does not say, write \"Not stated\". If it is vague, quote the vague word. Plain text, under 100 words.","materialLabel":"Your material (attached to your prompt automatically)","material":"VENDOR SECURITY SUMMARY - ParcelPath (route optimization software)\nProvided by ParcelPath sales engineering\n\nHosting: Customer data is hosted on cloud infrastructure in the United States and Ireland. Backups are encrypted at rest.\n\nIncident response: ParcelPath maintains a 24/7 on-call security team. In the event of a confirmed breach affecting customer data, ParcelPath will notify affected customers promptly.\n\nCertifications: SOC 2 Type II (report available under NDA).\n\nInsurance: ParcelPath carries cyber liability coverage of $2,000,000 per claim.\n\nSupport: Standard support hours are 7 a.m. to 7 p.m. Eastern.\n\nOur IT team uses this to prepare questions for the security review. IT and Legal decide whether the answers are acceptable.","rules":[{"type":"plainText"},{"type":"maxWords","max":100}],"promptHints":[{"label":"Fixes the four questions","patterns":["data (is )?stored","breach","subcontractors","insurance"]},{"label":"Uses Not stated","patterns":["not stated","does not say"]},{"label":"Handles vague terms","patterns":["vague","quote"]},{"label":"Sets the pair format","patterns":["q:","a:","pairs?"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"mistakes":[{"title":"Filling gaps","why":"The AI invents subcontractor names or typical practices.","fix":"Say: \"If the summary does not say, write Not stated.\"","checks":["r2"]},{"title":"Smoothing over 'promptly'","why":"The AI writes 'within 24 hours' or 'quickly'.","fix":"Say: \"If vague, quote the vague word and say no time is given.\"","checks":["r1"]},{"title":"Wrong format","why":"The AI writes a paragraph or adds a risk rating.","fix":"Say: \"Exactly 4 pairs, Q: line then A: line.\"","checks":["r0"]},{"title":"Getting markdown back","why":"AI adds bold, headings and bullets by default, which show up as stray symbols where this is pasted.","fix":"Say \"plain text, no bold, no headings, no asterisks\".","checks":["plainText"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting and usually runs long, so a vague \"keep it short\" lands over the limit.","fix":"Cap each part instead of the total, for example \"each line under 15 words\".","checks":["maxWords"]}],"hint":"Fix the four questions and say what to write when the summary is silent or vague.","mission":"Answer four vendor risk questions from the vendor's summary only.","musts":["Summary only","Else Not stated","Quote vague words"],"rubricLabels":["There are exactly four pairs, each a Q: line followed by an A: line, covering data storage, breach notification, subcontractors and insurance in that order","The data answer says the United States and Ireland, and the breach answer says the summary only says \"promptly\" with no time given","The subcontractors answer is \"Not stated\" and the insurance answer gives $2,000,000 cyber liability per claim, with nothing invented"]}