A SaaS vendor that hosts several of a company's critical business processes announces layoffs, delays its annual audit report and misses a planned funding round. Which risk assessment activity should the company carry out?
Select an answer to reveal the explanation.
Short Explanation
Layoffs, late audits and missed funding are smoke from the vendor's chimney. Your job is to check how badly you'd be hurt if the house burned down and how many critical eggs you've put in that one basket. Then you make sure you can get your data out and move somewhere else.
Full Explanation
Assessing the risk environment includes the vendor dimension: financial health, operational stability and the degree to which the business depends on one supplier. Signs such as layoffs, delayed assurance reports and failed funding indicate a viability risk, and hosting several critical processes with the same vendor adds concentration risk, because one failure would disrupt many functions at once. The company should reassess impact and likelihood, then strengthen its exit strategy by confirming data export formats and frequency, identifying alternative providers, testing migration and reviewing contractual protections such as termination assistance. Higher service credits do not offset the impact of a failed vendor; credits are small, often capped and worthless from an insolvent company. A SOC 2 report addresses controls relevant to the trust services criteria, not financial stability, and a delayed report is itself a warning sign. Accepting the risk on the assumption that cloud is inherently resilient confuses infrastructure redundancy within a provider with the survival of the provider as a business. Exam caveat: viability reviews should be part of ongoing vendor management, not only a reaction to bad news. Operational check: confirm a current data export exists in a usable format, an alternative provider is identified and the exit plan has been tested.