A critical service provider hosts the organization's customer data with a subcontractor that the organization has no contract with. What is the BEST way to address this fourth-party risk?
Select an answer to reveal the explanation.
Short Explanation
Your data doesn't care whose name is on the contract; it's exposed wherever it lands. Flow-down clauses carry your requirements down the chain to people you never signed with. The trap is thinking that no contract means no risk, or that a policy document is a promise.
Full Explanation
Fourth-party risk arises when a provider relies on its own suppliers to deliver services, so the organization's data and service depend on parties with which it has no direct relationship. The standard mechanism is to require the provider, through the contract, to flow down equivalent security obligations to its subcontractors, to remain responsible for their performance and to disclose material subcontractors. That extends enforceable requirements along the chain through the party the organization does contract with. Asking the subcontractor to email its policies once a year provides documents with no obligation behind them and no assurance that the policies are implemented or apply to the organization's data. Relying on public website statements is weaker still, since such statements are marketing, not commitments, and are not tailored to the services involved. Accepting the risk because the subcontractor is outside the contract misunderstands accountability: the organization remains accountable for its customers' data wherever it is processed, and acceptance would be a risk owner's decision made with full information, not a default. Exam caveat: for critical services, the organization may also seek assurance reports covering subcontractors or rights to assess them through the provider. Operational check: confirm that the provider contract contains flow-down and disclosure clauses and that the provider's subcontractor list is reviewed periodically.