Question

A financial services firm signs a contract with a SaaS vendor that processes sensitive customer data. During the security review, the firm's third-party risk manager discovers the SaaS vendor outsources its data hosting and backup operations to a separate cloud subcontractor located in another country. The firm's own regulators hold the firm accountable for protecting customer data end-to-end. What is the MOST effective action to address this supply-chain risk before signing?

Accepted Answer

Require contractual flow-down clauses that impose the firm's security and data-protection obligations on the vendor's subcontractors, plus rights to assess or obtain assurance over the fourth party

Answer

Accept the residual risk since the firm has a direct contract only with the SaaS vendor and cannot legally bind parties it has no relationship with

Answer

Purchase cyber insurance sufficient to cover any breach originating from the subcontractor's environment

Answer

Prohibit the vendor from using any subcontractors and require all processing to occur within the vendor's own facilities