The Vendor That Cannot Do SSO
A marketing analytics SaaS platform is up for renewal in ten days. It ingests 2.1 million customer records including contact details and purchase history, and the business sponsor says losing it would cost the quarter's campaign revenue. The vendor's current SOC 2 report carries three exceptions: no enforced MFA on the administrative console, a subprocessor in a jurisdiction the company has never assessed, and a 14-day delay in revoking access for terminated employees. The vendor cannot support SAML single sign-on for its admin console until next year and offers SMS-based MFA as an interim measure. The contract auto-renews if unsigned. Legal has not reviewed the data processing addendum. The security team has one week and no authority to block the purchase outright.
1. You cannot block it. What is the minimum set of conditions that makes signing defensible, and what do you do about the ten-day clock?
Read the worked answer
Separate the two clocks. The commercial deadline is ten days; the risk decision has no deadline and must not inherit one. The first move is to ask for a 30-day extension or an amendment, because a binary sign/no-sign framing is the vendor's frame, not yours.
Minimum conditions for a defensible signature:
- Admin accounts restricted to named individuals with no shared admin logins, plus an IP allowlist at the vendor's edge - this is the compensating control that substitutes for the missing MFA. Treat SMS as partial only, since it is defeated by SIM swap.
- Contractual right to audit and 30-day advance notice of any new subprocessor, plus a data residency commitment for the unassessed jurisdiction.
- A 24-hour revocation SLA with quarterly attestation until automated revocation exists.
- DPA signed and reviewed by legal before go-live, not after.
- A written residual risk statement with a named acceptor at executive level.
If conditions 1 to 3 cannot be met, the decision escalates to a named executive for explicit acceptance. What must not happen is the security team absorbing the risk silently and being blamed for it later.
2. Which of the three exceptions worries you most, and why not the one everyone else is focused on?
Read the worked answer
The revocation delay, not the MFA gap.
The MFA exception is loud: it is visible, it is discussed in every review, and it is partially mitigable with an IP allowlist and strict named-admin provisioning. Its exposure is bounded by how many administrators exist.
The 14-day revocation gap is silent and persistent. It means that on any given day, some number of people who no longer work for the company still hold administrative access to 2.1 million records. It generates no alert and no ticket; it is discovered only through an incident or an audit sample. Its exposure scales with attrition, not with headcount, and it is the exception most likely to appear in a breach notification letter.
The sleeper is the subprocessor. An unassessed jurisdiction is a legal and regulatory exposure that cannot be engineered around at all. MFA gaps and revocation delays can be controlled technically; contractual and jurisdictional exposure can only be controlled by legal, which is why it must not be left to the security team to resolve.
3. Write the one-line risk acceptance you would have signed, and say what you would refuse to sign.
Read the worked answer
What I would sign:
Residual risk - unauthorised administrative access to 2.1 million customer records via a compromised SMS-authenticated account. Likelihood: moderate. Impact: high. Compensating controls: IP allowlist, named administrators only, quarterly access review, revocation attested quarterly. Acceptance expires in 12 months or at contract renewal, whichever is earlier, and is re-reviewed against the next SOC 2 report.
Four elements make it defensible: the scenario is named, the controls are specific and testable, an expiry exists, and a re-review trigger exists. An acceptance without an expiry is a permanent decision made by someone who has left the room.
What I would refuse to sign:
- Acceptance of the unassessed subprocessor jurisdiction. That is a legal determination about regulatory exposure, not a security risk decision, and signing it would mean absorbing accountability I have no authority over.
- Any acceptance described as indefinite or until further notice.
- Any acceptance without a named individual accountable for it - an organisational acceptance is an acceptance by nobody.