Lesson 9 of 18 · about 30 minutes

Vendors, Contracts and Third-Party Risk

You'll be able to

Build a vendor inventory and sort vendors into tiers with a simple scored method
Read a SOC 2 report for period, scope, opinion, exceptions, subservice organizations and user entity controls
Write or check the contract clauses that law and customers expect, with the legal hook for each
Explain why a vendor that sits on a breach for days can consume your own notice clock
Control SaaS sprawl, shadow IT, software supply chain exposure and acquisition inheritance, and answer customer security questionnaires with a reusable evidence pack

Start here. This lesson is educational, not a substitute for the text of the law. It names the rule behind each point so you can read the official words. Dates and figures are as of October 2026.

You cannot outsource the duty. The FTC Safeguards Rule, HIPAA, the GDPR and Idaho's breach statute all keep the obligation with you while a vendor holds the data.
Third parties appear in a large and rising share of breaches. Trade press coverage of the 2026 Verizon report puts it at 48 percent, up from 30 percent a year earlier. Treat that as direction, not a quote for your firm.
Sort vendors into tiers. Spend your review time on the 5 to 10 percent that can hurt you, and give the rest a light intake form.
Put the clauses that matter in writing: security terms, a breach notice measured in hours, sub-processor control, audit rights, and return or deletion at the end.
A SOC 2 report is evidence, not a verdict. Read the period, the scope, the opinion, the exceptions and the list of controls you must run yourself.

Northfield Freight Services is an invented company with 200 employees. Last spring a payroll vendor changed hands, and the new owner moved employee records to a different cloud host. Northfield learned about it from a line in a newsletter. Nobody in operations knew the payroll vendor had a host. Nobody had a copy of the contract in a place they could find. When the owner asked a simple question, "who else has our people's Social Security numbers," it took three weeks to assemble an answer.

That story is made up, but every part of it is common. A business of 10 to 500 people usually runs on dozens to hundreds of outside services: payroll, email, file storage, accounting, a customer database, a website, a payment processor, a marketing platform, the managed IT provider and the software hiding inside all of them. The hands-on steps for choosing and securing business tools live in Securing Your Small Business Data and Systems. This lesson is the management side: knowing who they are, deciding how much to trust them, writing it down, and proving you did.

Why management owns the vendor problem

Two kinds of pressure make vendors a management topic. The first is the data. Verizon's 2026 Data Breach Investigations Report page confirms that exploitation of vulnerabilities is now the leading way in, at 31 percent of initial access, and that ransomware was present in 48 percent of breaches. Two trade press summaries of the same report give the third-party figure: 48 percent of breaches involved a third party, up from 30 percent the year before. I could confirm the first two figures on Verizon's own page but not the third-party number, so treat that one as secondary. It also happens to equal the ransomware figure, which is a coincidence worth checking against the report itself before you quote it to a board.

The second pressure is legal. The law does not let you point at the vendor.

Rule	What it says about vendors
FTC Safeguards Rule, 16 CFR 314.4(f)	Covered financial institutions must take reasonable steps to select and retain service providers that can maintain appropriate safeguards, require those safeguards by contract, and periodically assess each provider based on the risk it poses and the adequacy of its safeguards
HIPAA, 45 CFR 164.308(b) and 164.504(e)	A covered entity may let a business associate handle ePHI only with satisfactory assurances, documented in a written contract. The same applies from a business associate to its subcontractor
GDPR Article 28	The controller may use only processors providing sufficient guarantees. Processing is governed by a contract with listed terms, and the processor stays fully liable to the controller for its sub-processor
Idaho Code 28-51-105(2)	A commercial entity that maintains computerized data it does not own must notify the owner or licensee immediately following discovery of a breach if misuse of an Idaho resident's information has occurred or is reasonably likely, and must cooperate by sharing relevant information
PIPEDA, as explained by the Canadian Privacy Commissioner	The organization stays accountable for information it gives a processor, including one abroad, and must ensure comparable protection, mainly by contract

California's regulations add a contract rule for service providers and contractors under the CCPA. The current regulations page lists section 7051 as "Contract Requirements for Service Providers and Contractors," but I could not open the text of that section in this session, so check it directly if California consumer data goes to any vendor. Lesson 07 covers which state laws apply to you. PCI DSS has its own third-party service provider requirements, covered in lesson 05.

Step one: a vendor inventory you can trust

A vendor list nobody maintains is worse than none, because people believe it. Start with three sources and compare them: the accounts payable ledger for the last 12 months, the single sign-on or identity provider's application list, and a ten-minute interview with each department head. The ledger finds what you pay for. The identity list finds what employees log into. The interviews find what is paid for on a personal card or free of charge.

Field	Why it is there
Vendor and service name, owner at your company	Someone must be accountable. An unowned vendor does not get reviewed
What data they hold or touch (customer, employee, card, health, none)	Sets the tier and the clauses you need
How they connect (log in only, API key, network tunnel, admin rights, agent software)	Access is the route an attacker takes through a vendor
Where data is stored and which countries support staff sit in	Drives GDPR, PIPEDA and the DOJ rule questions in lesson 08
Sub-processors and hosting provider	Your fourth parties
Contract date, renewal date, notice period, breach notice term	Renewals are when you can negotiate. Missing a 90 day notice window costs a year
Evidence on file: SOC 2 or ISO certificate, PCI attestation, DPA signed, date of last review	Proof for auditors, insurers and customers
Tier, and the exit plan for Tier 1 vendors	Where you spend effort, and what happens if they fail

Step two: tier the vendors

You cannot give 200 vendors the same scrutiny. A scored tier lets you defend the choice later. The method below is a management tool of my own design for this lesson and not a regulatory formula. Score each vendor 0 to 3 on four questions, then add.

Question	0	1	2	3
Data sensitivity	None	Business data of low sensitivity	Personal data of customers or staff	Regulated or high-harm data: card, health, financial, government ID
System access	None	Log-in to their own tool only	API or integration with our systems	Admin rights, network tunnel or software agent on our devices
Business criticality	Nice to have	Slows work if down	Stops a team if down	Stops revenue or deliveries if down
Replaceability	Swap in a day	Swap in a week	Swap in a month	Swap takes a quarter or more

Totals of 9 to 12 are Tier 1, 5 to 8 are Tier 2 and 0 to 4 are Tier 3. A managed IT provider that holds admin rights over every laptop usually scores 3, 3, 3 and 2, which is 11. A free webinar tool with a sign-up email list scores 1, 1, 0 and 0, which is 2.

Tier	Review at intake	Review cycle	Contract terms
Tier 1	Full questionnaire, current SOC 2 Type 2 or equivalent, read by someone who can judge it, security review of access paths	Annual, and after any incident or ownership change	Full set from the clause table below, negotiated
Tier 2	Short questionnaire, certificate or report on file, DPA signed	Every two years, or at renewal	Standard security and breach notice terms
Tier 3	Intake form, terms of service read for data use, owner assigned	At renewal	Click-through terms accepted by an approved owner

Worked example: Northfield Freight tiers 214 vendors

After the payroll scare, Northfield's finance lead, the IT manager and the operations manager merge three lists: 148 vendors in the ledger, 91 applications in single sign-on, and 22 more named in interviews. After removing duplicates they count 214 vendors.

Scoring takes two afternoons. The result is 12 in Tier 1, 41 in Tier 2 and 161 in Tier 3. Check: 12 plus 41 plus 161 is 214.

Review hours are assumptions from the team's own experience: 10 hours per Tier 1 vendor each year, 3 hours per Tier 2 vendor every two years, and 15 minutes (0.25 hour) per Tier 3 intake.

Tier	Vendors	Hours each	Cycle	Hours per year
1	12	10	Yearly	12 x 10 = 120
2	41	3	Every 2 years	41 x 3 / 2 = 61.5
3	161	0.25	At renewal, assume once a year	161 x 0.25 = 40.25
Total	214			about 222 hours

Two hundred twenty-two hours is roughly a month and a third of working time for one person (at about 160 hours a month), spread over a year. Reviewing all 214 at the Tier 1 rate would take 2,140 hours, more than a full-time year. Tiering is what makes the program affordable. It also shows the board where the effort went: 54 percent of the hours (120 of 222) go to 5.6 percent of the vendors (12 of 214).

Step three: due diligence that produces evidence

Due diligence means asking the vendor for proof, then judging the proof. For a Tier 1 vendor the usual evidence is a recent independent report (SOC 2 Type 2 or ISO 27001 certificate with its scope and Statement of Applicability), a completed questionnaire, a penetration test summary, proof of insurance and a sub-processor list. For card data, the PCI attestation of compliance. For health data, a signed business associate agreement. Frameworks are explained in lesson 04.

Reading a SOC 2 report

A SOC 2 report is a CPA firm's report on a service organization's controls, measured against the AICPA's Trust Services Criteria. The AICPA's own SOC page sells the SOC 2 guide and warns service organizations and CPA firms to evaluate SOC providers carefully, noting that it refers unlicensed firms to state boards of accountancy. I could not read the paid guide, so the report layout below reflects common AICPA reporting practice. Check it against the report in your hand.

Look at	What to find	Warning sign
Type and period	Type 2 covers a stated period, commonly 6 to 12 months. Type 1 is one date	Type 1 only, a period under 3 months, or a period that ended over 12 months ago
Auditor's opinion	Unqualified means a clean opinion. Qualified, adverse or disclaimer are worse	Anything but unqualified, with no explanation from the vendor
Scope of the system	Which services, locations and criteria categories (Security always, others optional) the report covers	The product you buy is not the product in scope
Tests and exceptions	Each control, each test, the result. Exceptions are listed in the results section	Repeated exceptions in access reviews, change management or incident response
Subservice organizations	Carve-out method: the sub-vendor's controls are described but not tested here. Inclusive method: they are tested. Carve-out means you need that sub-vendor's own report	The hosting provider is carved out and nobody holds its report
Complementary user entity controls (CUECs)	The controls you must run on your side, such as removing departed employees promptly or reviewing user lists	You never read this list. It is the section that puts work on you
Gap since the report period	A short letter from the vendor, often called a bridge letter, saying controls have not materially changed since	None offered after a long gap

Treat the CUEC list as a task list for your own IT provider. A vendor can pass an audit and still be breached through a customer who never removed an ex-employee's account.

Questionnaires, both ways

You will send questionnaires and receive them. The public ones are worth knowing by name. The Cloud Security Alliance publishes the Cloud Controls Matrix, which it says has 197 control objectives in 17 domains, and the Consensus Assessments Initiative Questionnaire (CAIQ), a set of yes or no questions built into it. Version 4.1 combines the two. Its STAR registry has a Level 1 self-assessment and a Level 2 for certification or third-party attestation. EDUCAUSE publishes the Higher Education Community Vendor Assessment Toolkit (HECVAT, version 4.1.6 on its page) for colleges that buy from vendors. Shared Assessments publishes the SIG questionnaire. I did not retrieve a source for its current version, so confirm that with the publisher.

Who sends it	Typical form	How to answer efficiently
Enterprise or retail customers	Their own spreadsheet, or SIG, or CAIQ	Keep one master answer library, owned by one person, dated and reviewed twice a year. Attach your SOC 2 or policy set rather than retyping
Colleges and universities	HECVAT	Complete it once, update it yearly
Hospitals and health plans	Security questionnaire plus a business associate agreement	Have your HIPAA risk analysis date and policy list ready
Government and defense primes	NIST SP 800-171 or CMMC status questions	See lesson 04
Your insurer	Application with controls attestation	Answers must match what you tell customers. See lesson 12

The rule for answering is plain. Never say yes to a control that is not in place. A questionnaire signed by an executive is a representation, and a false one is the kind of statement the FTC treats as a deceptive practice. Keep the evidence file next to the answers.

Step four: contract clauses that carry weight

A contract does three jobs: it states what the vendor must do, it fixes who pays when something goes wrong and it gives you a clean way out. The table pairs each clause with the legal source that points to it, where there is one. Where I list a recommended number, it is a management recommendation and not a legal requirement.

Clause	What to require	Legal hook or reason
Use and instructions	The vendor uses your data only to deliver the service and on your documented instructions. No sale, no use to train its own products unless you agree in writing	GDPR 28(3)(a). HIPAA business associate permitted uses. Customer expectations about AI training, see lesson 13
Security standard	Name the measures: MFA, encryption in transit and at rest, access logging, patch timelines, an independent report each year	FTC Safeguards 314.4(f): require safeguards by contract. GDPR 28(3)(c)
Breach notice	Written notice within a fixed, short time of discovery, with a named contact and the facts you need. Recommend 24 to 72 hours and updates as facts develop	GDPR 33(2) (without undue delay). HIPAA 164.410 (outer limit 60 days). Idaho 28-51-105(2) (immediately following discovery)
Sub-processors	A current list, advance notice of changes, a right to object, and the same obligations flowed down	GDPR 28(2) and (4). HIPAA 164.504(e)(5) for subcontractors
Audit and evidence	Annual delivery of the SOC 2 or equivalent, a questionnaire response, and a for-cause audit right after an incident	GDPR 28(3)(h) requires information and audits to show compliance
Location and access	Where data sits and from which countries it can be reached. No access from countries you exclude	PIPEDA cross-border guidance. DOJ 28 CFR Part 202 restrictions on vendor agreements with covered persons
Return and deletion	Return of data in a usable format at the end, then deletion including copies and backups within a stated time, with written confirmation	GDPR 28(3)(g). HIPAA 164.504(e)(2)(ii)(J) (return or destroy if feasible)
Liability and indemnity	A cap that reflects the real exposure. Vendors often offer a cap tied to fees paid in the last 12 months. Ask for a higher "super cap" or no cap for data breach, confidentiality and indemnity of regulatory costs	No statute sets it. Common vendor practice, not a sourced figure
Insurance	The vendor carries cyber and technology errors and omissions insurance at stated limits and shows a certificate	Lesson 12
Continuity	Recovery time and recovery point commitments, tested backups, a notice of outages	Lesson 12
Cooperation	Help with your regulator notices, customer notices, forensic access and law enforcement requests	Safeguards 314.4(j), HIPAA, GDPR 28(3)(f)
Change of control and termination	Notice of sale or merger, a right to terminate if the new owner changes hosting or security, and transition help	The payroll story above

Why breach notice hours matter

Your clocks start when you discover or become aware, and the rules treat knowledge broadly. The Safeguards Rule's notice to the FTC is due as soon as possible and no later than 30 days after discovery of a notification event involving at least 500 consumers, and the rule attributes knowledge held by any employee, officer or other agent, other than the person who committed the breach, to the institution. HIPAA gives the business associate up to 60 calendar days after discovery to tell the covered entity, with knowledge of its employees, officers and agents imputed to it. Whether a particular vendor counts as your agent is a fact question that I cannot settle for you.

Worked example: a vendor that sits on it

Northfield is a financial institution under the Safeguards Rule because of a small equipment-financing line, and its tax-document portal is run by a vendor. The vendor finds a breach touching 1,800 Northfield customers on Day 0 and tells Northfield on Day 12.

If the vendor's knowledge counts as Northfield's, the 30 day FTC clock started on Day 0. Time left when Northfield hears: 30 minus 12 is 18 days. If the vendor's knowledge does not count, Northfield has the full 30 days from Day 12, which ends on Day 42. Nobody can say in advance which view a regulator takes.

The contract fixes the ambiguity. With a 48 hour notice clause, Northfield hears by Day 2 and has 28 days under either view. The clause costs nothing to include. It is cheaper than the argument.

Fourth parties, audits and the practical side of "right to audit"

Your vendor's vendors matter as much as the vendor. GDPR Article 28(4) makes the processor fully liable to the controller when a sub-processor fails, but liability is not a recovery plan. Ask each Tier 1 vendor for its sub-processor list and subscribe to change notices. When the list changes, treat it like a new vendor for that one component.

On audit rights, most SaaS vendors will not let a customer walk into the data center. The workable position is: annual independent report, the right to ask follow-up questions, a for-cause audit after a confirmed incident, and a limit on frequency. Spend the audit right where it counts. A for-cause audit clause that includes access to forensic findings is worth more than a yearly on-site visit.

Offboarding: how a vendor relationship ends well

Checklist: ending a vendor

Give notice inside the contract window, in writing, to the address the contract names.
Export your data in a format you can read. Test the export before the contract ends.
Revoke every access path: user accounts, API keys, OAuth grants, single sign-on connections, VPN or tunnel credentials, shared mailboxes and agents on devices.
Move any DNS, email forwarding and payment links that point to the vendor.
Get written confirmation of deletion, including backups and sub-processor copies, with the date.
Note any retention the vendor must keep by law and what protections continue for it.
Update the inventory, the data map and the sub-processor list in your customer notices.
File the confirmation with the contract so an auditor can find it later.

SaaS sprawl and shadow IT

Shadow IT is software employees use for work without approval. Most of it is harmless intent: a free file converter, a scheduling tool, a note app, an AI assistant. The risk comes from what gets uploaded and from sign-in connections that outlive the project. The rule for management is to make the safe path easier than the unsafe one, and to look for what already exists.

Discovery source	What it finds	Blind spot
Accounts payable and card statements	Paid tools, including on employee expense reports	Free tools
Single sign-on and identity provider logs	Apps people log into with company accounts	Apps with personal sign-ups
Third-party app grants in your email or file platform	OAuth permissions that let outside apps read mail and files	Tools used with no company account
Web proxy or DNS logs	Sites staff visit and upload to	Personal devices off the network
Department interviews	The reasons people adopted a tool	Things people forget or hide

A simple policy works: any tool that holds company or customer data goes through the Tier 3 intake form at minimum, and nothing with personal data of customers or staff goes in without an owner and a signed DPA. Pair this with the acceptable use policy in lesson 10. Generative AI tools are the fastest-growing case and get their own treatment in lesson 13.

Acquisitions: buying or selling a company with a data problem

When one company buys another, the buyer also buys the target's vendors, data and breaches. The SEC's 2018 order against Altaba, formerly Yahoo, is the standard case study in what goes wrong. The SEC announced on April 24, 2018 that Yahoo would pay a $35 million penalty to settle charges that it misled investors about a December 2014 intrusion. The agency said Yahoo's security team learned of the theft within days, the breach did not become public until 2016 while Yahoo was closing the sale of its operating business to Verizon, SEC filings over two years described only the risk of future breaches, and Yahoo lacked controls to make sure breach reports were evaluated for disclosure. Yahoo neither admitted nor denied the findings.

The lessons are practical. A buyer asks about past incidents, current security reports, vendor contracts and open regulatory questions. A seller prepares: a clean vendor inventory, the evidence file, an incident log with dates and a written explanation of anything unresolved. Contracts with vendors may restrict assignment or require consent on a change of control, so check the change-of-control clauses before the closing date.

Diligence request	What it tells the buyer
Incident log for 3 years with dates, scope, notices sent	Honesty and maturity of the response process
Latest risk assessment, framework status, SOC 2 or ISO scope	Control quality and what is outside it
Top 20 vendors with tiers, contracts, breach notice terms	Dependency and inherited contract risk
Regulator letters, complaints, demand letters	Open exposure
Data map showing where regulated data lives	What laws attach to the deal
Cyber insurance policy, claims history, renewal application	Insurability and what the insurer was told

Software supply chain and open source

The software you buy and the software your developers write both contain other people's code. A software bill of materials (SBOM) is, in CISA's words, a nested inventory, a list of ingredients that make up software components. Two cases show why the list matters. CVE-2021-44228, called Log4Shell, was published on December 10, 2021. It affected Apache Log4j2, scored 10.0 under CVSS 3.1 and was added to CISA's Known Exploited Vulnerabilities Catalog on the day it was published. CVE-2024-3094, published on March 29, 2024, described malicious code in the upstream release tarballs of the xz compression library, starting with version 5.6.0. Red Hat, as the assigning authority, scored it 10.0. Different failures, same lesson: you may not know the component is in your product until a notice arrives.

The standard references are the NIST Secure Software Development Framework, SP 800-218 version 1.1 (February 2022), and NIST SP 800-161 Revision 1 on cybersecurity supply chain risk management, whose update 1 is dated November 1, 2024. Federal rules and guidance on SBOMs and software attestations have shifted since 2021. I did not confirm their October 2026 status, so check CISA and the Office of Management and Budget before telling a customer you comply with a particular federal template.

For a smaller business the useful steps are modest. Ask software vendors whether they keep an SBOM and how fast they patch a critical flaw. If you build software, use a dependency scanner and pin versions. Subscribe to CISA's alerts. Add a contract clause that obliges a vendor to notify you of a critical vulnerability in its product and to patch within a stated time.

Foreign data access rules

The Department of Justice's Data Security Program (28 CFR Part 202) took effect on April 8, 2025. Due diligence and audit requirements were delayed until October 6, 2025. The Federal Register notice shows it governs access by countries of concern, naming China, to U.S. bulk sensitive personal data and government-related data, and that vendor agreements are one of the restricted transactions allowed only if security and other requirements are met. The bulk thresholds in 28 CFR 202.205 over the preceding 12 months are more than 100 U.S. persons for human genomic data, more than 1,000 U.S. persons for other human 'omic data or biometric identifiers, more than 1,000 U.S. devices for precise geolocation data, more than 10,000 U.S. persons for personal health or financial data, and more than 100,000 U.S. persons for covered personal identifiers. The rule defines the countries of concern as China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia and Venezuela. A business whose vendor has staff, contractors or sub-vendors in a country of concern with a path into your customers' data should add a contract clause barring that access and ask for the vendor's list of locations.

Common mix-ups

Claim: "The vendor is responsible if it is breached." What the evidence shows: The Safeguards Rule, HIPAA, GDPR and Idaho Code 28-51-105 keep duties with you, and the vendor's duty to tell you is a separate obligation.
Claim: "A SOC 2 means they are secure." What the evidence shows: It is an auditor's opinion on selected controls over a period, with exceptions and a scope that may leave out the service you use.
Claim: "If we use a big cloud provider, we do not need to worry." What the evidence shows: The provider secures its platform. You still configure access, backups and data location, and the SOC 2 will list controls for you to run.
Claim: "Reviewing every vendor equally is the safe approach." What the evidence shows: It spreads effort thin. Northfield's tiering put 54 percent of review hours on 5.6 percent of its vendors.
Claim: "Our contract says the vendor will notify us promptly, so we are covered." What the evidence shows: "Promptly" is not a number. A regulator's clock runs from discovery, and a few days of silence consumes it.

Questions to ask a vendor, or your IT provider about its vendors

What data of ours do you hold, where is it stored and which countries can your staff reach it from?
Which report do you hold, for what period, and which services and criteria are in scope? May we see the complete report and the list of exceptions?
Which sub-processors and hosting providers do you use, and how will you tell us about changes?
Within how many hours will you notify us of a suspected incident, and to whom?
Do you use our data to train models or improve products? What is the switch to turn that off?
What are your recovery time and recovery point commitments, and when did you last test a restore?
If we leave, how do we get our data out, in what format, and when do you delete it and your backups?
What insurance do you carry, at what limits, and can we see the certificate?

Reporting angle

What a manager should ask for each quarter: the number of vendors by tier and how many changed; the count of Tier 1 vendors with a current independent report (and the oldest report date); open vendor findings by age; vendors past their review date; contracts missing a breach notice term or DPA; sub-processor change notices received and reviewed; shadow IT tools discovered since the last report and how many were brought under contract or removed; and incidents at vendors with how many hours passed between the vendor's discovery and its notice to you.

A one-page board exhibit works: a table of Tier 1 vendors with columns for service, data held, report type and date, last review, open issues and contract renewal date. Add the headline: share of Tier 1 and Tier 2 vendors with all evidence current.

Evidence for auditors and insurers: the inventory with dates, signed DPAs and business associate agreements, copies of the reports with the reviewer's notes, the questionnaire answers, and the written offboarding confirmations. Contact points: the FTC breach notification form for Safeguards Rule events of 500 or more consumers, the HHS Office for Civil Rights breach portal for HIPAA, the attorney general's office of each state whose residents were affected, and the lead data protection authority named in your EU representative appointment.

Research angle

16 CFR 314.4, the Safeguards Rule elements, including service provider oversight in (f).
45 CFR 164.504(e), 164.308(b) and 164.410 for HIPAA business associate contracts and notice.
GDPR on EUR-Lex, Articles 28 and 33.
Idaho Code 28-51-105 from the Idaho Legislature.
NIST SP 800-161 Rev. 1 and NIST SP 800-218 (SSDF), with CISA's SBOM page.
AICPA SOC suite of services, the CSA Cloud Controls Matrix and CAIQ and the HECVAT.
SEC press release on the Altaba (Yahoo) order and California's CCPA regulations page.

Questions and answers

How many vendors should we expect to find?

More than you think. Northfield, with 200 employees, found 214 across the ledger, single sign-on and interviews, and 22 of those turned up only in conversation. Treat the first inventory as a draft and expect the count to rise 10 to 20 percent as departments remember tools.

Do we need a SOC 2 from every vendor?

No. Tier 1 vendors should have one or an equivalent independent report. Tier 2 vendors can offer a certificate, a questionnaire or a report. Tier 3 vendors get terms and an owner. Be clear about what each tier needs before you ask, because vendors answer the question they are given.

What if the vendor refuses to negotiate its standard contract?

That is common with large platforms. Then the work moves to compensating decisions: limit the data you put in, enable every security setting you control, keep your own backups, record the accepted risk in the register and have the owner sign it. Compare alternatives at renewal.

Is an SBOM something a small company needs?

If you buy off-the-shelf software, you rarely need to hold one. You do need the habit of asking vendors how fast they patch critical flaws and whether they can list their components. If you build software, an SBOM from your build tools is cheap and answers a customer's question quickly.

Who in the company owns vendor risk?

Each vendor has a business owner who bought it, and one named person runs the program: often the security lead, operations manager or finance lead in a firm your size. The board sees the Tier 1 table. Procurement should not be able to sign a Tier 1 or Tier 2 contract without the intake review.

How should we answer a customer questionnaire we cannot fully meet?

Answer truthfully, with the date you expect to close the gap, and attach a plan. A "partially" with a date is credible. A "yes" that cannot be proved is a liability. If a requirement is outside your size or business, say why and offer the control you do have.

What belongs in the incident plan about vendors?

A contact list with named people and phone numbers for each Tier 1 vendor, the notice term from its contract, the point at which you invite the vendor's incident team into your calls, and a rule that nobody agrees to a customer or regulator statement about a vendor event without the person who owns notices. Lesson 11 builds the plan.

Does a vendor's breach count as ours for state breach laws?

Often the notice duty to individuals rests with the owner of the data, which is you, while the vendor owes you notice. Idaho Code 28-51-105(2) puts the duty on the entity maintaining data it does not own to notify the owner or licensee immediately following discovery. Lesson 07 covers the state laws and who sends the letters.

Hard questions

"Our vendors are bigger than we are and will not sign anything. Why bother?"

Because the file shows what you did. Many large vendors have a standard data processing addendum and a public trust page, and you can accept those after reading them. Where they decline a term, you record the risk and compensate with your own controls. An auditor or insurer wants to see that you looked.

"A SOC 2 costs the vendor real money, and we are paying for it. Isn't the questionnaire enough?"

A questionnaire records what the vendor says. A SOC 2 Type 2 report records what an independent CPA firm tested over a period. Both have value, and a Tier 3 vendor should not be pressed for the second. For a Tier 1 vendor holding regulated data, the report is the stronger evidence, and the AICPA's own warning about quick-turn SOC engagements is a reason to read who signed it.

"The contract says the vendor must notify within 72 hours. Doesn't that put us in the clear?"

It helps. It does not move your clock. Your own deadlines run from your discovery, and the rules attribute an agent's knowledge to you. The clause buys time inside the window. It does not remove the duty to notify customers or regulators.

"We found 40 unapproved tools. Do we ban them?"

Not on day one. Sort them by tier. Bring the useful ones under contract, move data off the risky ones and block the rest with a notice that gives the approved alternative. A blanket ban without alternatives sends the tools to personal accounts, where you can no longer see them.

"If a supply chain flaw like xz or Log4Shell hits, what could a 150-person company have done differently?"

It could not have prevented the flaw. It could have known what it ran, been able to find affected systems in hours instead of weeks, and had vendors obliged to tell it. Those are inventory and contract tasks, which are within reach of a company that size.

Check yourself

1. What does the FTC Safeguards Rule, 16 CFR 314.4(f), require a covered financial institution to do about service providers?

2. Under 45 CFR 164.410, a HIPAA business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and in no case later than how long after discovery?

3. A vendor's SOC 2 report uses the carve-out method for its cloud hosting provider. What does that mean for you as a customer?

4. GDPR Article 28(2) says a processor wants to bring in a sub-processor. What must happen?

5. A vendor scores 3 for data sensitivity, 3 for system access, 2 for business criticality and 1 for replaceability on a 0 to 3 scale. Using the tier rule in this lesson (9 or more is Tier 1, 5 to 8 is Tier 2, 4 or less is Tier 3), what tier is it?

6. What happened in the xz incident recorded as CVE-2024-3094?

Terms in this lesson

Third-party risk: The chance that a vendor, supplier, service provider or software component you depend on causes you a loss, such as a breach, an outage or a legal violation.
Vendor tiering: Sorting vendors by how much harm they could cause you, so the heaviest review and the strongest contract terms go to the few that matter most.
SOC 2 report: A CPA firm's report on a service provider's controls against the AICPA Trust Services Criteria. Type 2 covers a period of time and tests whether the controls worked.
Subservice organization: A vendor that your vendor relies on to deliver part of its service, such as a cloud host. In a SOC 2 report it is either carved out of the testing or included.
CUEC: Complementary user entity controls: the controls a SOC 2 report says the customer must run on its own side, such as removing departed employees' access, for the vendor's controls to work as described.
Data processing agreement (DPA): The contract terms under which a vendor handles personal data for you: instructions, security, sub-processors, breach notice, audits and return or deletion.
Shadow IT: Software or cloud services employees sign up for and use for work without IT or management approval.
SBOM: Software bill of materials: a nested inventory, a list of ingredients, of the components that make up a piece of software.

Full glossary

Sources

16 CFR 314.4, FTC Safeguards Rule elements, including (f) overseeing service providers and (j) notice to the FTC checked 2026-10
45 CFR 164.504(e), HIPAA business associate contracts checked 2026-10
45 CFR 164.308(b), HIPAA business associate contracts and other arrangements checked 2026-10
45 CFR 164.410, notification by a business associate checked 2026-10
GDPR Article 28, processor (text read through the gdpr-info.eu mirror of the Official Journal; official text on EUR-Lex) checked 2026-10
GDPR Article 33, breach notification (including 33(2), processor to controller) checked 2026-10
Idaho Code 28-51-105, disclosure of breach of security of computerized personal information checked 2026-10
OPC Canada, Guidelines for processing personal data across borders checked 2026-10
California Privacy Protection Agency, CCPA regulations page (current text effective January 1, 2026; section 7051 is listed as Contract Requirements for Service Providers and Contractors) checked 2026-10
Federal Register, DOJ Preventing Access to U.S. Sensitive Personal Data (28 CFR Part 202; effective 8 April 2025; vendor agreements are restricted transactions) checked 2026-10
Verizon, 2026 Data Breach Investigations Report landing page (31 percent exploitation of vulnerabilities; ransomware in 48 percent of breaches) checked 2026-10
eSecurity Planet, 2026 Verizon DBIR (third parties in 48 percent of breaches, up from 30 percent; trade press summary of the report) checked 2026-10
AICPA and CIMA, SOC suite of services (SOC 2 guide listing and notice on choosing SOC providers) checked 2026-10
SEC, Altaba (formerly Yahoo) charged with failing to disclose massive cybersecurity breach, USD 35 million penalty (24 April 2018) checked 2026-10
Cloud Security Alliance, Cloud Controls Matrix and CAIQ v4.1 checked 2026-10
EDUCAUSE, Higher Education Community Vendor Assessment Toolkit (HECVAT 4.1.6) checked 2026-10
NVD, CVE-2021-44228 (Apache Log4j2, Log4Shell) checked 2026-10
NVD, CVE-2024-3094 (xz) checked 2026-10
CISA, Software Bill of Materials (SBOM) checked 2026-10
NIST SP 800-161 Rev. 1 (update 1, 1 November 2024), cybersecurity supply chain risk management checked 2026-10
NIST SP 800-218, Secure Software Development Framework v1.1 (February 2022) checked 2026-10