The Vendor Outage During Peak Enrollment
A benefits agency's online enrollment portal, run by a third-party vendor under a $2.1M annual contract, failed for 31 hours during the final week of open enrollment. About 14,000 applicants could not submit. The contract has a service-level agreement with credits capped at 5% of monthly fees and a limitation-of-liability clause capping damages at 12 months of fees. The vendor's post-incident report attributes the outage to a configuration change the vendor made without notifying the agency, but the agency's own change-management policy was never shared with the vendor. The agency's regulator has asked for a written assurance that applicants were not disadvantaged. Staff manually processed 3,200 applications over the following weekend using overtime. The agency has no documented disaster-recovery test in the past three years.
1. Identify the compliance and contractual exposures and rank them by urgency.
Read the worked answer
Ranking by urgency (likelihood × harm):
Regulatory assurance (highest). The regulator has asked a direct question. The agency must be able to show that no eligible applicant lost benefits because of the outage. That requires reconstructing which 14,000 were affected, whether deadlines were extended, and whether the 3,200 manual cases were handled equitably. If the answer is 'we don't know,' that is the real exposure - not the outage itself.
Change-management gap (high). The vendor made an unannounced change, but the agency never shared its policy. This weakens any claim that the vendor breached a known requirement. The agency should fix the contract and the practice, not just argue fault.
Contractual recovery (moderate). The 5% credit cap and 12-month liability cap mean the agency will recover very little financially. Pursuing damages is likely not worth the relationship cost; the leverage is renewal and scope, not litigation.
Disaster-recovery evidence (moderate). Three years without a test is a finding waiting to happen. It should be remediated on a dated plan.
The manual overtime is a cost and a fairness issue but is lower urgency than the regulatory response.
2. What should the agency demand from the vendor, and what should it fix internally, before contract renewal?
Read the worked answer
From the vendor:
- A root-cause report with the specific configuration change, who approved it, and why notification failed.
- A written change-notification protocol with defined lead times and an agency approval gate for production changes during protected periods (open enrollment).
- Evidence of a disaster-recovery test within the last 12 months, or a dated commitment to one before renewal.
- Revised SLA terms: outage credits that scale with affected users, not a flat 5% cap, and a defined remediation timeline.
Internally:
- Publish the agency's change-management and incident-notification policy to the vendor and incorporate it by reference into the contract.
- Build an enrollment-deadline extension rule so a future outage triggers automatic relief rather than an ad hoc weekend of overtime.
- Establish a joint incident-response runbook with named contacts on both sides.
- Document the manual processing of the 3,200 cases so the regulator's question can be answered with evidence.
The negotiation posture should be: the agency shares blame for the missing policy, which justifies a cooperative fix rather than a punitive one - but renewal is contingent on the DR test and the revised SLA.