A vendor that processes customer data was onboarded and paid for months before the security team learned of the contract, because purchasing signs agreements without any information risk step. What should the information security manager do to BEST address the root cause?
Select an answer to reveal the explanation.
Short Explanation
If the gate's at the wrong end of the field, the horse is already out. You fix third-party risk by putting the risk check inside procurement, before the signature, and not by reviewing every purchase order on the planet.
Full Explanation
The root cause is a process gap: procurement can commit the organization to a third party that handles sensitive data without anyone assessing the information risk. The effective response is to embed a risk assessment step in the procurement process itself, triggered by criteria such as data access, criticality or connectivity, so that security requirements and contract terms are set before signature. Integrating risk into existing business processes is more sustainable than relying on the security team to discover vendors after the fact. Reviewing and terminating existing contracts addresses the current population, but it is disruptive, may breach agreements and does nothing to stop the next unreviewed contract. Requiring security approval of every purchase order regardless of value or data access is not risk-based; it overloads the security team, slows the business and invites workarounds. A right-to-audit clause is a valuable contract term, yet it is only one control and depends on a review step to ensure it is included and exercised; it does not assess the vendor before onboarding. Exam caveat: the vendor already in place still needs assessment, but the question asks about the root cause. Operational check: confirm the procurement workflow cannot complete a contract that meets the risk criteria without a recorded security review.