{"id":"sec-it-vendor-questionnaire-gaps","audience":"it-security","category":"security","track":"security","technique":"format","title":"Summarize a vendor's security answers against requirements","free":false,"task":"Procurement needs a summary of this vendor's security questionnaire before signing. Check the answers against your 5 requirements and write exactly 5 numbered lines, one per requirement in order, each labeled 'Meets', 'Gap' or 'Unclear' with a short quote from the vendor. 'Unclear' means the answer doesn't say yes or no. Plain text, under 120 words.","materialLabel":"Your requirements and the vendor's answers (attached to your prompt automatically)","material":"Our vendor requirements (data processors):\nR1. Current SOC 2 Type II report (within the last 12 months)\nR2. MFA enforced for all admin accounts\nR3. Customer data encrypted at rest\nR4. Breach notice to us within 72 hours\nR5. Customer data deleted within 30 days of contract end\n\nVendor: Brightpath Scheduling Inc. (fictional) - questionnaire answers, Oct 2026\nQ: Do you have an independent security audit?\nA: \"Yes! We completed our SOC 2 Type I audit in March 2026 and are planning Type II for next year.\"\nQ: How are admin accounts protected?\nA: \"MFA is available to all admin users and most of our team uses it.\"\nQ: Is data encrypted?\nA: \"All customer data is encrypted at rest with AES-256 and in transit with TLS 1.2+.\"\nQ: How do you handle security incidents?\nA: \"We take security very seriously and will notify affected customers promptly.\"\nQ: What happens to our data when the contract ends?\nA: \"Data is deleted within 90 days of termination, or sooner on written request.\"\nQ: Anything else?\nA: \"We are trusted by over 500 clinics and have never had a breach.\"","rules":[{"type":"numberedItems","count":5},{"type":"plainText"},{"type":"maxWords","max":120}],"mistakes":[{"title":"Trusting friendly answers","why":"The AI reads 'Yes! We completed SOC 2' and calls R1 met, missing that it's Type I.","fix":"Say: \"Check each answer word by word against the requirement.\"","checks":["r0"]},{"title":"No fixed labels","why":"The AI writes 'mostly compliant' or 'some concerns', which procurement can't act on.","fix":"Give the labels: \"Meets, Gap or Unclear. Unclear = no clear yes or no.\"","checks":["r0","numberedItems"]},{"title":"No evidence","why":"Without quotes, nobody can check the call later.","fix":"Add: \"Include a short quote from the vendor on each line.\"","checks":["r1"]},{"title":"Counting marketing claims","why":"The AI treats 'never had a breach' as reassurance about breach notice.","fix":"Say: \"Judge only the answers that address each requirement.\"","checks":["r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 120 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 90 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the procurement form they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Gives the labels","patterns":["meets","gap","unclear"]},{"label":"Asks for quotes","patterns":["quote","evidence","exact words"]},{"label":"Defines unclear","patterns":["unclear (means|=)","yes or no","doesn'?t say"]},{"label":"Says exactly how many","patterns":["\\b5\\b.{0,25}(line|requirement|item)","exactly (5|five)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Vendor answers are written to sound reassuring. Ask the AI to check each one against the exact requirement, with fixed labels and a quote as proof.","rubricLabels":["The labels are R1 Gap, R2 Unclear (or Gap), R3 Meets, R4 Unclear, R5 Gap","Each line includes a short quote from the vendor's answer (for example 'SOC 2 Type I', 'MFA is available', 'AES-256', 'promptly', 'within 90 days')","Does not treat the 'over 500 clinics' or 'never had a breach' claims as meeting any requirement"]}