Security and compliance questions · Questions you will be asked

Answer the security review

Decide which of six live security-review questions you answer on the call and which you route, and give the words for one of each.

casemediumExercise · 4 min · 48 of 64

On this page

The customer's security lead has picked six questions to ask live, and each answer either closes a line of her review or reopens it. The case turns on knowing which of the six are yours.

The situation

Week 3 of the 8-week claims-triage pilot. The customer's security lead has booked 45 minutes on Thursday for six of the questionnaire's 60 questions. The pilot runs in the customer's cloud tenant and calls a hosted model API on your company's account. The prompt carries the redacted loss description and the policy wording; the redaction missed 3% of personal mentions on a 200-description sample. The prompt log is kept 30 days in the tenant. You sign in through the customer's SSO. Your company's SOC 2 Type II report covers a period that ended seven months ago and does not describe deployments in customer tenants; its data processing agreement says breaches are notified "without undue delay". Her review takes two to six weeks; the budget closes in week 11.

Where is the prompt processed, and what is in it?
Does the model provider train on our data?
Will you notify us of a breach within 24 hours?
Who at your company can read our claims?
Is this service covered by your SOC 2 report?
How long is our data kept, and where?

The question

Decide which of the six you answer on the call and which you route to your security team, and write what you say for question 3 and for question 4.

A strong answer · Rubric · Where answers go wrong

Write your answer first, then open

A strong answer

Sort by deployment against company, as the questionnaire does.

Questions 1 and 6 are the deployment's, answered in full. For 1: one outbound path, to the provider's named region, carrying the redacted loss description and the policy wording; the redaction misses about 3% of mentions, so some personal data does leave, and you show the sample. For 6: the prompt log is kept 30 days in her tenant and deleted by a scheduled job whose last run you name; the provider keeps what its terms say, clause attached.

Questions 2 and 4 split. The deployment's half is yours. For 4: "One named engineer, me, through your SSO, in a group that expires at pilot end plus 14 days. I read the output table and the prompt log, nothing in the base tables." For 2: the calls run under a business agreement that excludes training on inputs, clause attached. The company halves (whether that stays contractually true, and which of our support staff can reach customer data) are routed.

Questions 3 and 5 are routed whole. For 3: "That is a commitment about our company's incident response, not this deployment. Our security team answers it in writing so it matches our processing agreement; you will have it by Monday." Not "yes": a 24-hour promise in her minutes beside "without undue delay" in the agreement is two answers to reconcile. For 5: "The report covers our platform, not deployments in your tenant. Our security team sends it under NDA with a bridge letter for the seven months, by Monday; this deployment's controls are on the data-boundary page you have."

Started this week, even a six-week review ends in week 9, inside the week-11 close.

Rubric

sorts each question by deployment or company, and splits questions 2 and 4 rather than forcing each into one pile
answers the deployment questions by pointing at evidence (the sample, the SSO group and its end date, the deletion job, a clause), not with an assurance
says that some personal data leaves, with the 3% figure, rather than "nothing leaves"
routes questions 3 and 5 with a sentence that names an owner and a date, and gives no breach-notice number
notices the seven-month-old report period and asks for a bridge letter
places the review's worst case against the week-11 budget close

Where answers go wrong

"Yes, 24 hours is fine, we move fast on incidents." Loses because it contradicts the vendor's own processing agreement: when the security team's written answers arrive two weeks later, procurement holds two answers to one question, the review restarts in week 5, and a six-week review ends in week 11 with no slack.

"I'll take all six away and come back with written answers." Loses because the security team does not know the deployment and answers questions 1 and 6 generically; the security lead concludes the engineer cannot describe their own data flow, and a week goes on a second call.

"No personal data leaves your tenant; we redact." Loses because it is false at 3%, and the first name she finds in a sampled prompt discredits the other five answers.