A hospital system contracts with a cloud-based Electronic Health Records (EHR) vendor. During a risk assessment, the security team discovers that the EHR vendor delegates its database backup and data archiving operations to an external sub-processor. Which of the following risk management controls best ensures that third-party and fourth-party security standards are maintained throughout this supply chain?
- Enforce contractual requirements that compel the primary vendor to flow down security controls and grant right-to-audit permissions for sub-processorsAnswer
- BConduct independent external vulnerability scans against the sub-processor's backup infrastructure without primary vendor involvement
- CRequire the primary vendor to execute a standard Service Level Agreement (SLA) to guarantee database backup uptime metrics
- DClassify the sub-processor as a low-risk entity and limit security assessments exclusively to the primary vendor's perimeter
Answer
Enforce contractual requirements that compel the primary vendor to flow down security controls and grant right-to-audit permissions for sub-processors.
Contractual flow-down clauses ensure that the primary vendor binds any sub-processors (fourth parties) to the same security standards and audit obligations agreed upon with the customer. This ensures end-to-end supply chain visibility and accountability.
Step-by-Step Solution
Key Concept
Fourth-Party Risk Management and Flow-Down Contractual Provisions