SaaS Renewal With an Unaudited Subprocessor
A healthcare payer uses a SaaS analytics vendor for claims anomaly detection. The vendor processes PHI for 2.1 million members. Its latest SOC 2 Type II report has a carve-out: the subprocessor hosting the data warehouse is excluded from audit scope. The contract, signed three years ago, has no right-to-audit clause and no subprocessor notification requirement. Renewal is in 28 days; annual spend is $1.8M. The vendor says it cannot complete a new SOC 2 before renewal and offers a security questionnaire instead. The business owner says switching would delay a Medicare Advantage bid by six months. Legal says breach notification obligations remain with the payer. The vendor's subprocessor is in a country with no adequacy decision. The vendor has offered a 15% discount for a three-year renewal signed within 14 days. You are the security program manager and must make a recommendation to the risk committee.
1. What risk decision and conditions should you recommend for renewal?
Read the worked answer
Do not accept an unconditional three-year renewal for a 15% discount; the discount locks in an unaudited subprocessor and no audit rights. Recommend a conditional one-year renewal with: subprocessor disclosure and prior notice of changes; a right to audit or acceptance of an independent assessment such as SOC 2 plus a bridge letter; a security addendum with breach notification within 24 hours; data-residency and transfer-mechanism confirmation; and termination assistance. Because the subprocessor country lacks an adequacy decision, require a transfer impact assessment and, if needed, supplementary measures such as customer-managed keys and field-level tokenization. The business delay is real, so treat this as a risk tradeoff: accept limited residual risk for one year while requiring remediation milestones, or reject if the vendor will not disclose the subprocessor. The questionnaire alone is not equivalent to an audit; it is evidence of intent, not control effectiveness. Escalate the decision to the risk committee with the business impact and the residual risk stated.
2. What interim controls and contractual terms would you require?
Read the worked answer
Interim controls: minimize PHI sent to the vendor through tokenized member IDs and suppressed free-text fields; enable customer-managed encryption keys if supported; monitor egress and anomalous queries through CASB and DLP; restrict vendor access to least privilege with just-in-time elevation; and log all API access. Contract terms: a subprocessor list with 30-day change notice, audit rights, 24-hour incident notification, data deletion and return, liability for subprocessor acts, and a security addendum flowing down to the subprocessor. If the vendor refuses audit rights, require an annual independent penetration test summary and a completed CAIQ. Map each control to the specific gap: the carve-out is the main unknown, so the priority is visibility into the subprocessor, not another general questionnaire. The program manager should explain which controls reduce likelihood, which reduce impact, and which merely provide evidence.
3. How should the residual risk be documented and owned?
Read the worked answer
Document in the risk register: inherent risk from PHI volume, the audit carve-out, and the no-adequacy country; current controls; residual risk; owner, which should be the business vice president rather than security; acceptance expiry at 12 months or the next renewal; conditions; and monitoring metrics such as subprocessor changes, audit evidence receipt, and incident notifications. Note that legal breach notification remains with the payer, so residual risk is not transferred. Set escalation triggers: a missed remediation milestone, a subprocessor change, or a security incident. The program manager should also record any dissenting opinion if the business accepts more risk than security recommends. This makes the acceptance auditable and time-bound rather than a permanent invisible exception, and it gives the risk committee a clear basis for revisiting the decision.