Renewing a High-Risk Vendor in 21 Days

Treat the SOC 2 as evidence, not a verdict. Map it to your own control requirements and rate residual risk on likelihood times impact.

• The subprocessor carve-out is the largest gap: 1.4 million records, claim narratives, a jurisdiction where you could not compel cooperation, and no examined controls. Likelihood of a control failure there is not low; impact is regulatory and reputational as well as contractual.
• 15 of 200 access reviews without evidence (7.5%) suggests the review process is not operating consistently. Ask for the sampled population, the reviewer identity, and proof that excessive access was actually removed - not a commitment to improve.
• Impact: 3.2 million policyholders, special-category health data, GDPR exposure and state insurance supervision. Expected annual loss plausibly crosses the $5M board threshold once notification, credit monitoring, regulatory penalty and claims-processing disruption are included.

Evidence to demand within 21 days, with a hard date:

• The subprocessor's own SOC 2 or ISO 27001 plus bridge letter, and a data-flow diagram showing whether EU data reaches that country.
• Access review evidence for the failed sample and next quarter's results.
• Penetration test summary, encryption and key-management description, 24 months of incident history, full subprocessor list, and breach notification commitments.

If the subprocessor report does not arrive, silence is not a pass.

Must-have, walk away without them:

• Breach notification to you within 24 hours of awareness, with defined content and cooperation obligations.
• Audit rights extending to subprocessors, including remote audit or additional evidence where a report has carve-outs.
• A security schedule with measurable controls (encryption in transit and at rest, MFA, logging, vulnerability remediation SLAs), not 'reasonable security'.
• Data residency: EU data stays in the EU, with prior notice and an objection right before any new subprocessor.
• Return and deletion with certification, plus termination for cause without penalty on material breach. The 90-day notice is meaningless as leverage if you cannot exit.

Negotiable: on-site versus remote audit, insurance limits above a sensible floor, remediation timelines measured in weeks rather than days.

If the vendor refuses the must-haves: escalate to their executive sponsor, and in parallel start an exit plan and a compensating-control package - tokenise or truncate claim fields so full narratives never leave your environment, restrict the data set, ingest their logs into your SIEM, and require annual attestations. Then take a time-bound risk acceptance to the board with a named owner and review date. Procurement's wish to sign this week is a schedule, not an argument, and 'we ran out of time' is not a defensible due-diligence position to a regulator.

One page and one decision.

• The decision required: approve or reject a time-bound risk acceptance for renewing on current terms, or authorise the exit programme with its budget. Name the individual accountable, not 'the security team'.
• The exposure in business terms: 1.4 million records including health claim narratives; an unexamined subprocessor in a jurisdiction where you could not compel cooperation; no contractual breach-notification deadline, so you may learn about a breach from a customer or a regulator.
• Scenario, not control list: a plausible incident, the affected population, notification and remediation cost, regulatory action, and the operational impact if claims processing stops for a week. Give a range with assumptions rather than one precise number.
• Options with cost and risk: renew as-is (highest residual risk, lowest cost); renew with compensating controls and contract changes (medium risk, medium cost, three to six months to implement); exit to an alternative (highest transition cost, lowest residual risk, nine to eighteen months).
• Recommendation, owner, review date, and the specific fact that would change your mind.

Boards act on accountability and options, not on SOC 2 page counts. If the answer is accept, make the acceptance time-bound and return it for review in 90 days, because the 90-day termination notice means the next real decision point arrives sooner than anyone expects.