Third-Party and Supply Chain Risk
Third-Party and Supply Chain Risk tests whether you can manage dependency risk before, during, and after a vendor relationship. GCT-2A-324 questions focus on vendor tiering, assurance reports, contract controls, subcontractor visibility, and software supply-chain evidence such as SBOMs and provenance.
Core rules and concepts
- Tier vendors by data sensitivity, system criticality, access level, and concentration risk. Critical vendors need deeper due diligence and continuous monitoring than low-risk suppliers.
- SOC 2 Type I covers design at a point in time; Type II covers operating effectiveness over a period. Read the scope, period, exceptions, and complementary user entity controls. An ISO/IEC 27001 certificate covers the certified scope, not every product or location.
- Contracts should include security requirements, breach notification timelines, data processing terms, subprocessor approval, right to audit, confidentiality, return/destruction of data, and termination assistance.
- Fourth parties and subcontractors can inherit risk. Map concentration and single points of failure, including cloud and open-source dependencies.
- Software supply-chain controls include SBOMs, signed artifacts, provenance attestations, dependency pinning, and verification in CI/CD. SLSA describes supply-chain integrity levels; Sigstore/cosign supports signing and verification.
Worked example
A SaaS vendor will process customer records and integrate with the identity provider. Because the data is regulated and the integration is privileged, the vendor is tiered critical. Due diligence requests a SOC 2 Type II report covering the relevant service over the last 12 months, the ISO/IEC 27001 certificate scope, a DPA, a security addendum with 24-hour breach notification, subprocessor notice, and an exit plan for data return and deletion. The contract includes a right to audit and annual reassessment. The reasoning: a certificate is a starting point; the report period, scope, exceptions, and contractual enforceability determine whether risk is actually managed.
Traps that cost marks
- Treating a SOC 2 report or ISO certificate as a complete security guarantee.
- Ignoring report scope, period, exceptions, and complementary controls.
- Missing subcontractor and fourth-party exposure, or concentration risk.
- Having no offboarding plan for data return, deletion, and access removal.