The Vendor Hosting the Claims Portal
A mid-sized broker outsources its customer claims portal to a hosting provider under a three-year contract. The provider stores data in two data centres in the same city and takes nightly backups to tape held in a third facility 4 km away. The contract includes a 99.9% uptime commitment measured monthly, with service credits capped at 10% of the monthly fee. The broker's regulator requires notification of material outages within 72 hours. In March the provider suffered a ransomware incident: the portal was down for 31 hours, and the provider restored from tape, losing 14 hours of submitted claims. The provider disclosed the outage to the broker on day four, after the regulatory deadline, and stated that the incident was 'contained' without providing the forensic report.
1. Evaluate the contractual and assurance weaknesses this incident exposes.
Read the worked answer
Four weaknesses. First, resilience: two data centres in one city and tape 4 km away are effectively a single geographic failure domain, so the provider's 'dual site' claim provides little protection against a city-scale event. Second, recovery objectives: the contract commits to uptime but not to recovery point or recovery time objectives, so a 14-hour data loss breaches no contractual term. Third, notification: the contract does not impose a disclosure deadline aligned to the broker's 72-hour regulatory obligation, so the broker learned on day four and was already late through no fault of its own. Fourth, remedy: a 10% credit cap on a monthly fee is trivially small against regulatory exposure and customer harm, so the provider bears almost none of the consequence.
The assurance failure is separate and arguably worse. 'Contained' is an assertion, not evidence. Without the forensic report the broker cannot determine whether its data was exfiltrated, which determines whether it has a personal data breach notification obligation independent of the outage.
2. What should the broker do in the immediate term, and what should it demand before accepting the provider's assurance?
Read the worked answer
Immediate term: notify the regulator of the outage and of the data loss, explaining that the broker's own assessment is incomplete because the provider has not supplied the report - do not wait for the provider. Assess the 14 hours of lost claims, contact affected customers, and reconstruct submissions from any channel records. Preserve the broker's own logs, because they may be the only independent evidence of what was submitted.
Before accepting assurance, demand: the forensic report or an executive summary sufficient to state whether data was accessed or exfiltrated, and the scope of systems affected; the root cause and the specific entry vector; evidence that the vulnerability is remediated, not merely that systems are back up; and confirmation of whether backups were in scope of the encryption, since tape restoration succeeded but that does not prove the tapes were unaffected.
Accepting 'contained' without any of this would leave the broker unable to answer the regulator's most basic question, and would waive its strongest lever while the incident is still fresh.
3. Recommend the contract changes for renewal, and identify which are realistically negotiable.
Read the worked answer
Changes: (1) explicit RTO and RPO with credits tied to data loss, not just downtime; (2) a notification deadline of 24 hours from the provider's awareness, with the obligation triggered by suspicion rather than confirmation, so the broker can meet its 72-hour duty; (3) a right to the forensic report and to audit, and a duty to cooperate with the regulator; (4) geographically separated backup with at least one copy outside the region, and tested restoration; (5) uncapped or substantially raised liability for confidentiality breach, with credits as a service remedy and not a liability cap; (6) exit provisions - data return in a usable format and transition assistance.
Realistically negotiable at renewal: notification deadlines, audit rights, RTO/RPO and backup geography, because these are standard and the provider's competitors offer them; the broker has leverage at renewal and should use it. Harder: uncapped liability, which most providers resist, though a separate super-cap for data protection breach is often achievable.
If the provider refuses notification and audit rights outright, that is itself the finding: the broker cannot meet its own regulatory obligations on those terms and should treat the renewal as a sourcing decision, not a negotiation.