Question

A financial services company relies on three critical SaaS vendors for payment processing, fraud detection, and customer identity verification. During an annual third-party risk review, the risk manager discovers that all three vendors host their production workloads with the same single cloud infrastructure provider in the same geographic region. Each individual vendor has strong SOC 2 Type II reports and acceptable individual risk scores. Which risk should the risk manager escalate as the MOST significant finding?

Accepted Answer

Concentration risk from a shared fourth-party dependency that could cause simultaneous outages across multiple critical services

Answer

Each vendor's SOC 2 Type II report may be outdated and should be reassessed more frequently

Answer

The vendors have not provided evidence of encryption at rest for stored payment data

Answer

The absence of individual service-level agreements (SLAs) with each SaaS vendor