A company discovers that its SaaS vendor stores customer data only in another country with different privacy laws, and that the vendor uses a proprietary data format that would make migrating to another provider slow and costly. Which two third-party limitations does this describe?

Third-party risk assessments must account for limitations that constrain the customer's options. Geography and jurisdiction matter because data stored in another country falls under that country's laws, which can affect privacy rights, government access, breach notification, and data transfer obligations, and may conflict with the customer's own regulatory requirements. Vendor lock-in arises when proprietary formats, integrations, or contract terms make it costly or impractical to leave a provider, reducing the customer's leverage and complicating exit planning. The scenario describes both precisely. Staffing limitations concern the people available to manage or assess vendors, and conflict of interest concerns personal stakes that bias selection; neither is described. Resource availability refers to the budget, tools, or time available for vendor management, and assurance mechanisms are the means of gaining confidence in a vendor, such as audits or attestations; the scenario is about data location and portability, not internal resources or evidence. Environment constraints relate to the technical or operating environment, and return on investment concerns financial justification; neither addresses foreign legal exposure or migration difficulty. Exam caveat: these limitations are usually handled contractually with data residency commitments and exit clauses. Operational check: confirm the contract specifies data storage locations and a documented, tested data export process.