grceng.academy
YAML lab 45 bonus XP

Turn the contract into a control map

Start labRead the room

Objectives

Legal is proud of the new vendor contract template: right to audit, 72-hour breach notice, subprocessor change approval, deletion on exit. None of these clauses has ever been exercised, drilled or monitored. Legal calls the template 'strong'.

Build the clause-to-control map: each obligation becomes a control with an owner, a test, and an evidence source, plus the disclosure feed that keeps the fourth-party graph current.

Contract clauses (template v3)

clause 8.1  right to audit, annually, on 30 days notice
clause 8.4  breach notification within 72 hours
clause 9.2  subprocessor changes require approval; notice 30 days prior
clause 11.3 all data deleted within 30 days of termination
clause 12.1 vendor maintains a current subprocessor list (URL)

Checks the server runs (6)

  • Every clause in the fixture is mapped
  • Each mapping names a test, an owner and evidence
  • The breach-notice clause drills against a monitored channel
  • Subprocessor change is a decision, not a countdown to consent
  • The subprocessor list is ingested and diffed
  • Fourth parties shared across vendors are flagged

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    One entry per clause

    The fixture lists five clauses. The map needs an entry for each, addressed by its clause number, because 'covered by the template' is not verifiable and 'clause 8.4' is.

    Every clause in the fixture is mapped

  2. Step 2

    Each obligation gets a control shape

    For every clause: who owns it, how it is tested, and what artefact the test produces. An audit right exercised never is the same as no audit right, only more expensive to negotiate.

    Each mapping names a test, an owner and evidence

  3. Step 3

    Drill the 72 hours

    The breach-notice clause failed in the room's scenario because the notice landed in an unread inbox. The control is a monitored channel plus a drill, and the drill is the evidence.

    The breach-notice clause drills against a monitored channel

  4. Step 4

    Make silence loud

    Subprocessor change notices expire into consent by default. The gate inverts that: a notice opens a review task, and no decision before the deadline escalates instead of approving.

    Subprocessor change is a decision, not a countdown to consent

  5. Step 5

    Watch the chain, not the vendor

    Ingest the subprocessor list from the URL in clause 12.1 and diff each version, so new fourth parties appear when they are added. Then flag fourth parties shared across your Tier 1 vendors: that is concentration you own whether or not you chose it.

    The subprocessor list is ingested and diffedFourth parties shared across vendors are flagged

Rules summary

  • XP on pass

    45 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 11 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.