Third-Party Risk and Contractual Gaps in a Payment Processor Acquisition
A mid-sized payment processor, PayFlow, has just acquired a smaller competitor, QuickPay. During integration, the security team discovers that QuickPay's cardholder data environment (CDE) relies on a third-party tokenization service, TokenSafe, which is not PCI DSS certified. TokenSafe's contract with QuickPay, signed 18 months ago, includes a right-to-audit clause but no requirement for annual SOC 2 reports or PCI attestation. QuickPay's CISO had verbally assured the board that TokenSafe was 'PCI compliant' based on a vendor questionnaire. PayFlow's board now demands immediate assurance that the CDE is compliant. PayFlow's own PCI assessment is due in 60 days. The TokenSafe contract auto-renews in 90 days with a 60-day notice period. PayFlow's legal team estimates that renegotiating the contract to include PCI attestation would take 45 days and cost $50,000 in legal fees. Alternatively, PayFlow could replace TokenSafe with a certified tokenization provider, but that would require a 6-month migration and $500,000. The board wants a recommendation within two weeks.
1. What are the key risks PayFlow faces regarding TokenSafe, and how should they be prioritized?
Read the worked answer
The key risks are: (1) Compliance risk: TokenSafe is not PCI DSS certified, and PayFlow's CDE depends on it. PCI DSS requires that service providers be compliant, and PayFlow's own assessment in 60 days could fail if TokenSafe cannot provide evidence of compliance. (2) Contractual risk: The existing contract lacks requirements for annual SOC 2 reports or PCI attestation, and the right-to-audit clause is insufficient without a defined audit scope. The auto-renewal in 90 days with a 60-day notice period means PayFlow must act quickly to avoid being locked in for another term. (3) Reputational and financial risk: If a breach occurs due to TokenSafe's non-compliance, PayFlow could face fines, lawsuits, and loss of customer trust. Prioritization: The most urgent is the compliance risk because the PCI assessment is imminent (60 days). The contractual risk is also time-sensitive due to the auto-renewal notice period. The reputational risk is a consequence of the other two. Therefore, PayFlow should first address the immediate compliance gap by obtaining a attestation of compliance (AOC) or a compensating control, then renegotiate the contract to include PCI attestation and audit rights before the notice period expires, and finally plan for a longer-term vendor replacement if TokenSafe cannot comply.
2. Evaluate the options: (a) renegotiate the contract, (b) replace TokenSafe, (c) do nothing and rely on the verbal assurance. What are the trade-offs, and what would you recommend?
Read the worked answer
Option (a) Renegotiate: Takes 45 days and $50,000, but can include PCI attestation and audit rights. This addresses the compliance gap within the 60-day PCI assessment window if TokenSafe can provide the attestation quickly. However, TokenSafe may not be able to achieve PCI certification in time, and the renegotiation may fail. Option (b) Replace: Costs $500,000 and takes 6 months, which is too long for the 60-day PCI assessment. It would require a compensating control for the interim. It provides a long-term solution but is expensive and disruptive. Option (c) Do nothing: Relies on a verbal assurance, which is not evidence. This is unacceptable because it leaves PayFlow exposed to compliance failure and potential breach. Recommendation: Pursue (a) immediately, but with a fallback. Start renegotiation now, demanding that TokenSafe provide a PCI attestation within 30 days or a plan to achieve it. Simultaneously, initiate a contingency plan to implement a compensating control (e.g., additional segmentation or encryption) to satisfy PCI DSS for the upcoming assessment. If TokenSafe cannot provide attestation by the deadline, exercise the termination option before the auto-renewal notice period and begin migration to a certified provider, using the compensating control until migration is complete. This balances cost, time, and risk.