Examkin

Question

Difficulty: HardThird-Party Risk Management and Supply Chain Oversight

A healthcare provider contracts a third-party software vendor to maintain its remote patient monitoring platform. During a compliance audit, the security team discovers that the vendor transferred customer data backups to an unvetted sub-processor to reduce hosting expenses. The existing contract includes non-disclosure obligations, minimum uptime guarantees, and annual on-site audit privileges, but lacks restrictions regarding sub-tier service providers. Which of the following contractual provisions should the security team mandate in future procurement agreements to directly restrict unauthorized downstream vendor engagements?

  1. A mandatory sub-processor authorization and notification clause requiring prior written approvalAnswer
  2. B
    A Service Level Agreement (SLA) specifying financial penalties for data availability threshold breaches
  3. C
    An Interconnection Security Agreement (ISA) defining technical network interface controls between systems
  4. D
    A Business Continuity Plan (BCP) mandate specifying a strict Recovery Point Objective (RPO) for backups

Answer

A mandatory sub-processor authorization and notification clause requiring prior written approval
Including a sub-processor notification and mandatory authorization clause ensures that vendors cannot legally transfer sensitive data or infrastructure operations to fourth parties without the primary organization's explicit review and consent. This directly addresses supply chain visibility and downstream risk exposure.

Step-by-Step Solution

1
Analyze the scenario vulnerability
Identified that the risk stems from fourth-party (sub-tier) outsourcing without organization knowledge or security vetting.
The primary vendor subcontracted backup services to an unauthorized entity due to missing contractual boundaries around sub-tier processing.
2
Evaluate existing contract limitations
The current terms (confidentiality, uptime SLA, standard auditing) fail to govern supply chain sub-contracting practices.
Auditing privileges and confidentiality enforce baseline security for the primary vendor, but do not automatically restrict the vendor's choice of subcontractors.
3
Select the appropriate governance control
Enforce sub-processor notification and authorization requirements in vendor contracts.
Requiring prior written approval and advance notification gives the organization the legal right to veto high-risk fourth-party sub-processors before data is shared.

Key Concept

Fourth-Party Risk Management and Sub-Processor Governance
Estimated Time:2m 0s
Rate this question

Topics

Third-Party Risk Management and Supply Chain Oversight

More questions from this topic