No hints and no pre-cut findings. Each scenario hands you a vendor's due-diligence pack - SOC 2 extracts, questionnaire answers, contract clauses, pen-test summaries - and you click the individual lines that are red flags. You are scored on precision and recall, so flagging every clause costs you as much as missing the one that matters. Then tier the vendor, make the call, and name what your own organisation still has to do.
A customer-support SaaS is about to receive the names, contact details and support history of 400,000 customers. The due-diligence pack looks clean at a glance. Find the lines that are not, tier the vendor, and decide what has to change before go-live.
A payroll processor sends 'our SOC 2 Type II' and a bridge letter. Read what the report actually says, how old it is, and what the letter is being asked to cover - then decide whether there is any assurance left to rely on.
A fraud-scoring API with a clean Type II report and a clean questionnaire. Somewhere in the carve-outs, the sub-processor annex and the pen-test scope is the company that actually does the work.
The contract has ended and the vendor has sent a deletion certificate. Before you sign off the exit, check what the certificate covers, what came back, and what is still connected on your own side.