MSSP Auto-Renewal After a Missed POS Incident
Rivet Retail operates 1,200 stores and outsources 24/7 security monitoring to an MSSP. The three-year contract auto-renews in 45 days. It has no right-to-audit clause, no requirement to disclose subcontractors, and a 15-minute triage SLA. Last quarter the MSSP averaged 42 minutes. The MSSP uses an offshore subcontractor for tier-1 triage. In a recent POS malware incident, alerts sat for six hours and 4,000 card records were exposed. The MSSP says the subcontractor is outside the contract scope and denies responsibility. Rivet has PCI DSS obligations and a board meeting in two weeks. The CISO wants to exit, the CFO wants to renew because switching costs are estimated at $800,000, and the COO wants assurance that stores will not be disrupted during the holiday season.
1. Assess the third-party risk and contract gaps. What should Rivet do before the auto-renewal deadline?
Read the worked answer
Assessment. This is a high-risk outsourcing arrangement with weak contract levers. No right-to-audit means Rivet cannot independently verify controls. No subcontractor disclosure means tier-1 triage is performed by an unseen party. The 15-minute SLA was missed by 27 minutes on average, and the six-hour incident is a material failure. The MSSP's denial of responsibility suggests the contract does not allocate subcontractor risk. Rivet retains PCI DSS accountability; outsourcing does not transfer it.
Before auto-renewal. Send written notice to prevent automatic renewal if the contract allows. Demand the subcontractor list, the subcontract, incident timeline, triage logs, and evidence of PCI DSS responsibilities. Convene legal, procurement, security, and store operations. Do not accept the MSSP's scope argument without a contract review. Prepare a remediation notice and a reservation of rights. In parallel, assess whether the incident triggers customer or card-brand notification obligations. The judgment is to preserve optionality before the deadline; auto-renewing without audit rights would lock in the same risk for another three years.
2. Compare renewing with renegotiated terms, exiting, and a transitional hybrid model. Recommend one with conditions.
Read the worked answer
Options. Renew as-is: lowest transition cost but unacceptable risk. Renegotiate: add audit rights, subcontractor approval, 24/7 visibility, 15-minute triage with credits, incident notification, cooperation, and termination for cause. Exit: highest assurance but $800,000 and holiday disruption. Hybrid: retain the MSSP for monitoring while adding an independent triage or response provider and internal oversight.
Recommendation. Renegotiate with a 90-day performance improvement plan and a termination right if triage misses persist. If the MSSP refuses audit rights or subcontractor disclosure, move to the hybrid model and prepare an exit. Make renewal conditional on a security addendum, evidence of tier-1 controls, and a joint incident response test before the holiday season. The CFO should compare the $800,000 switching cost with the cost of another 4,000-record breach, card-brand fines, and customer loss. The COO needs a transition plan that does not reduce store coverage. The judgment is to use the renewal deadline as leverage, not to treat it as a binary renew-or-exit choice.
3. Define the ongoing vendor governance and reporting Rivet should require regardless of the decision.
Read the worked answer
Ongoing governance. Assign a vendor owner in security and a business owner in operations. Maintain a risk tier and a due diligence file. Require monthly service reviews with triage time, alert volume, false positives, missed alerts, and incident timelines. Require quarterly attestations and annual right-to-audit or independent assurance. Maintain a subcontractor register with approval rights and flow-down obligations. Define incident notification within one hour for suspected card data exposure. Test the joint incident response plan twice a year. Report to the board risk committee quarterly: SLA performance, open findings, subcontractor changes, and incident lessons. Include termination and transition clauses. The judgment is that vendor governance is continuous; a strong contract is useless without service reviews and evidence.