Question

A financial services firm relies on a cloud-based payment processor that was assessed and approved during onboarding 18 months ago. Since then, the vendor has undergone a merger, changed data center providers, and experienced two publicly reported minor outages. The firm's risk committee is concerned that its third-party risk posture is based on stale information. Which approach BEST addresses the committee's concern going forward?

Accepted Answer

Establish a continuous vendor monitoring program using threat intelligence, security ratings, and periodic reassessment triggered by material changes

Answer

Require the vendor to submit a new SOC 2 Type II report only when the contract comes up for renewal

Answer

Transfer the residual risk by increasing the firm's cyber insurance coverage limits

Answer

Add a contractual clause requiring the vendor to notify the firm of any breach within 72 hours