Signing a SaaS Vendor Whose SOC 2 Excludes the Only System That Matters
A payments-adjacent fintech with 700 staff processes card data for 60 merchant clients. Procurement wants to sign a three-year contract in 12 days with a new cloud call-recording SaaS vendor that will receive the first 90 seconds of every customer service call, including card numbers customers read aloud. The vendor supplied a SOC 2 Type II report whose scope section explicitly excludes the call-recording processing environment, an ISO 27001 certificate valid for 8 more months, and no penetration test summary. The contract's breach notification clause is 30 days “after confirmation”, it permits subprocessors in any country, and it grants no audit right. The risk appetite statement says residual High risks require CISO and CFO joint sign-off plus a documented treatment plan with an owner and a date. The vendor will not accept a security addendum before signature and is the only shortlisted option; the business case claims $2.1M in annual savings.
1. Assess the risk and state your recommendation. What makes this High rather than Medium?
Read the worked answer
Inherent risk is High, and residual is High because the controls are unverified.
- Data: recordings containing spoken card numbers pull the vendor into PCI scope. If a PAN reaches them, they are a service provider requiring a written agreement and defined responsibilities - the 90-second window does not help.
- Assurance gap: the SOC 2 excludes the call-recording environment, the only part that matters. ISO 27001 certifies a management system, not the controls on this data, and the certificate carries no test detail.
- Contract: 30-day post-confirmation breach notice is far too slow; unrestricted global subprocessors remove data-residency control; no audit right means you cannot test any claim the vendor makes.
- Concentration and schedule pressure: sole shortlisted vendor and a 12-day deadline are risk factors, not justifications.
Recommendation: do not sign as-is. Approve conditionally with a treatment plan, named owners, and dated milestones, and escalate to CISO and CFO per the appetite statement. The $2.1M saving is real but is the wrong comparator - weigh it against a card-data breach affecting 60 merchant clients, contract terminations, and forensic cost.
The strongest move is not contractual: stop sending PANs to the vendor. That changes the risk instead of monitoring it.
2. Identify compensating controls and contract terms that would reduce residual risk, ranked by effectiveness.
Read the worked answer
Rank by whether a control eliminates the risk, reduces it, or merely documents it.
1. Eliminate the data (most effective). Pause-and-resume recording, DTMF/voice masking, or speech redaction so card numbers never reach the vendor; agent-assisted entry if customers insist on speaking the PAN. This takes the vendor out of card scope and moves the finding from High to Medium regardless of contract language. Fund it as part of the deal.
2. Reduce exposure. Customer-managed encryption keys or vendor-side field encryption for audio; data residency pinned to an approved region; a published subprocessor list with prior notification and an approval right; deletion and return on exit with written certification.
3. Detect and verify. Breach notification within 24–72 hours of discovery rather than after confirmation; the right to request the SOC 2 with the recording environment in scope; a penetration test summary or the right to commission one; incident cooperation obligations; and security-addendum acceptance as a condition subsequent with a dated milestone and a termination right if unmet.
Be explicit that contract terms are weaker than architecture: a 72-hour notice clause still means 72 hours after a breach in a system you cannot audit. Present the addendum as risk reduction, not risk elimination.
3. How do you document the decision and monitor it, given that the business may sign within 12 days?
Read the worked answer
Document in the risk register: a unique ID, the inherent and residual ratings, the specific scope exclusion quoted from the SOC 2, the treatment plan with owners and dated milestones, and the acceptance signed by both CISO and CFO - the appetite statement requires both, so a single signature is non-compliant regardless of who is available.
Frame the acceptance as conditional, not blanket: approved subject to (1) a security addendum with 72-hour notification, subprocessor approval, and an audit right by a named date; (2) evidence that the recording environment is in scope of the next SOC 2 or of a penetration test, by a named quarter; (3) PAN-redaction live in production by a named date. Every condition needs a date and a business owner, not a security owner.
Monitor: a quarterly evidence request triggered by the treatment plan, review at the next risk committee, and an exception expiry that forces re-approval instead of silent rollover. Add a termination-for-failure trigger so an unmet condition has a consequence.
If the business signs before conditions are met: record it as an accepted risk with the residual restated in business terms for the CFO, and set a monitoring gate. You cannot block a commercial decision, but you can ensure the record shows what was known and who accepted it - while continuing to drive the redaction control, the only item on the list that actually shrinks the exposure.