Scoring a Supplier Nobody Can Visit
Northgate Health Partners is selecting a cloud provider for a patient appointment system. The provider is based overseas, has no UK data centre, and will store records in two regions. Northgate's risk team runs a qualitative assessment and scores the supplier's likelihood of a data breach as 'low' because the supplier holds ISO/IEC 27001 certification and returned a 240-question security questionnaire with no major gaps. The impact score is 'high' because the data is special category health information. The combined rating lands in the 'medium' band, which under Northgate's matrix requires only annual review. A board member asks whether the assessment is sound. Separately, the supplier's sub-processor list includes a analytics firm that Northgate has never heard of.
1. Critique the risk assessment methodology used here and identify what has been conflated.
Read the worked answer
The assessment has conflated assurance evidence with likelihood of occurrence. ISO/IEC 27001 certification confirms that a management system exists and was audited at a point in time; it does not certify that controls are effective against this specific threat model, and it says nothing about the supplier's breach history, staff turnover, or the security posture of its sub-processors. A clean questionnaire measures the supplier's ability to answer questions, which correlates weakly with actual risk.
Second, the impact score is doing all the work and the likelihood score is doing none. Special category health data carries regulatory, clinical, and reputational consequences that justify treating even a low-likelihood event as significant. A medium band that triggers only annual review is disproportionate to the impact.
Third, the rating treats the supplier as a single entity. The sub-processor introduces a distinct risk: data leaves the assessed boundary and is processed by an organisation Northgate has not evaluated. Each material sub-processor should be assessed in its own right, or at minimum the supplier's sub-processor governance should be scored.
Fourth, cross-border storage in two unspecified regions creates legal and jurisdictional risk that a generic questionnaire will not surface.
A sounder approach separates the components: score likelihood on evidence specific to the service (breach history, sub-processor control, data location, audit scope covering the actual service), score impact on the data classification, and record the confidence level in each score. Where confidence is low, the residual risk should be treated as higher, not lower. The board member is right to challenge it.
2. Recommend how Northgate should handle the sub-processor and the cross-border element before signing.
Read the worked answer
Treat the sub-processor as a separate risk decision, not a footnote. Northgate should require a current list of sub-processors with the specific function each performs, the data each can access, and the location of processing. For the analytics firm specifically, ask what data it receives - if appointment records or identifiers reach it, that is a new processing activity requiring its own assessment and likely its own contractual terms.
Contractually, Northgate needs: notification and approval rights before new sub-processors are engaged, flow-down of security and data-protection obligations, audit or assessment rights covering sub-processors, and breach notification timelines that allow Northgate to meet its own regulatory deadlines. If the supplier cannot grant these, that is a finding to weigh in the decision.
On cross-border storage, the question is not only where the servers are but who can access the data and under whose law. Northgate should document the legal basis for each transfer, confirm whether government or law-enforcement access in those jurisdictions could reach the records, and check that the two regions are named and contractually fixed rather than changeable at the supplier's discretion. Encryption with keys held by Northgate reduces, but does not eliminate, the exposure.
Finally, record the outcome as a formal risk acceptance with conditions, owned by an accountable executive, listing the sub-processor approval right, the data-location commitment, and a review trigger if the supplier changes either. That converts an unexamined gap into a monitored obligation.