Question

During onboarding of a new SaaS vendor that will process customer payment data, the vendor risk assessment identifies that the vendor lacks encryption for data at rest. The contract is scheduled to be signed next week, and the business unit is eager to proceed to meet a product launch deadline. As the risk practitioner advising the process, what is the BEST course of action before the contract is finalized?

Accepted Answer

Recommend delaying signature until a remediation commitment with defined timelines and contractual safeguards is agreed with the vendor

Answer

Allow the contract to proceed since the business owner accepts the risk to meet the launch deadline

Answer

Require the vendor to be replaced immediately with a fully compliant alternative regardless of cost

Answer

Document the gap in the risk register and revisit it during the annual vendor review cycle