Question

A financial services firm is completing a vendor risk assessment on a SaaS provider that will process regulated customer data. During the review, the security team discovers the SaaS provider relies on a separate third-party analytics company to enrich data, and that analytics company in turn uses an offshore IaaS provider for compute. The firm's regulator holds it accountable for the full processing chain. Which action best addresses the enterprise risk this arrangement creates?

Accepted Answer

Require contractual flow-down clauses obligating the SaaS provider to bind its subcontractors to equivalent security, breach-notification, and audit obligations, and to disclose fourth-party dependencies

Answer

Accept the residual risk since the firm's contract is only with the primary SaaS provider and downstream parties are outside the firm's contractual scope

Answer

Terminate the engagement because any use of subcontractors by a SaaS provider is prohibited under standard outsourcing risk frameworks

Answer

Rely solely on the SaaS provider's SOC 2 Type II report, which automatically covers all subcontractors in the processing chain