Four SaaS Vendors, One Cloud Region, Sixty Days to Renewal
Harborline Asset Management runs four critical services: a SaaS CRM, a SaaS HR platform, a SaaS e-signature tool, and portfolio analytics on one hyperscaler region. All four vendors depend on the same cloud region, and two share a subprocessor that stores data outside the firm's approved jurisdiction. Contracts promise 99.9 percent uptime but contain no RTO, RPO, test evidence, or termination assistance. A six-hour regional outage took CRM and e-signature offline; traders used spreadsheets and email approvals. The regulator has asked for evidence that impact tolerances are met and for the firm's concentration risk assessment. The largest vendor renews in 60 days, and procurement recommends accepting a 12 percent discount in exchange for removing audit rights. The firm manages $2.4 billion and has 900 staff.
1. How do you assess and treat the concentration risk before renewal?
Read the worked answer
Map the dependency chain beyond the four contracts. For each service, identify the cloud region and availability zones, the subprocessors, data residency, identity providers, network providers, and any shared recovery dependencies. Two vendors using the same out-of-jurisdiction subprocessor is a legal and operational concentration, not just a technical one. Build a scenario: a six-hour regional outage plus a subprocessor failure. Test which business processes stop, which manual workarounds exist, and how long they remain acceptable.
Quantify impact tolerance for trading support, client onboarding, HR payroll, and contract execution. Compare the 99.9 percent uptime promise, about 8.8 hours a year, with the actual six-hour outage and the absence of RTO and RPO commitments. The promise is not evidence of resilience.
Treat the risk in layers. Avoidable: move one of the two jurisdiction-sensitive services to an approved subprocessor or require data localization. Mitigable: require a secondary region for portfolio analytics, a documented manual fallback for CRM and e-signature, and annual test evidence. Accepted: retain some concentration where exit cost exceeds benefit, with a board-approved statement and a tested exit plan. Do not accept the 12 percent discount for removing audit rights; that trades evidence for a small saving.
2. What contractual terms and evidence should be required at renewal, and why?
Read the worked answer
Require service-level commitments that match business tolerances: RTO and RPO by critical function, not just uptime; recovery priority; maximum data loss; and defined degraded-mode performance. Require annual evidence: independent assurance reports, summary penetration test results, business continuity and DR test results, and notification of material changes. Add audit rights, including the right to review subprocessor controls and to use a mutually agreed assessor.
Add subprocessor notice and approval, data residency commitments, and a prohibition on moving data without consent. Require a tested exit plan: data export in a usable format, transition assistance for a defined period, deletion certification, and escrow or source-code access where relevant. Include security incident notification timelines, cooperation with regulators, liability for prolonged outage, and insurance. Define termination assistance fees in advance so exit is not held hostage at renewal.
The reason is leverage. After the outage, the firm has evidence that uptime language alone does not protect clients or satisfy the regulator. These terms convert vague promises into verifiable obligations and make the concentration risk manageable rather than hidden.
3. What evidence should go to the regulator and the board, and what interim controls are needed?
Read the worked answer
Send a concise resilience package: the critical service inventory, impact tolerances, dependency and concentration map, the six-hour outage timeline, actual recovery and data loss, the contractual gaps, the remediation plan with owners and dates, and the board or committee minutes showing challenge and approval. State what is not yet evidenced rather than overclaiming. Include the manual workaround test results and the exit-plan status.
For the board, show the concentration as a small number of scenarios with financial and client impact, not a vendor list. For the regulator, show that the firm understands fourth-party risk and has a dated plan.
Interim controls: document and rehearse manual procedures for CRM and e-signature; require daily export of critical data; monitor vendor status and subprocessor changes; set a 30-day renewal decision gate; and commission a tabletop with the four vendors. Do not wait for contract renegotiation to test workarounds. The regulator is asking for evidence of operational resilience, which means demonstrated capability, not contractual intent.