Third-Party and Supply Chain Risk Management
Domain 7 tests the full vendor lifecycle and the extended supply chain, including fourth parties and concentration risk.
Core rules
- Tier third parties by criticality, data access, and business dependency; due diligence depth should follow tier.
- Contractual controls include right-to-audit, breach notification, subprocessor approval, data return or deletion, and SLA remedies.
- SOC 2 reports cover controls at the vendor but exclude complementary controls at the customer; read the scope and carve-outs.
- Monitor continuously: financial health, security ratings, incidents, subcontractor changes, and concentration.
- Plan exit and transition before onboarding, including data portability and alternate suppliers.
Worked example
A bank onboards a cloud payment processor. The vendor provides a SOC 2 Type II, but the report excludes the bank's own configuration controls and one subprocessor in a non-approved jurisdiction. The bank requires the subprocessor to be disclosed and approved, adds a contractual audit right, and documents the complementary controls it must operate. The residual risk is accepted at the business-unit level with quarterly monitoring. The reasoning separates vendor-side assurance from customer-side responsibility and treats the fourth party as part of the risk.
Traps
- Treating a completed security questionnaire as continuous assurance.
- Ignoring fourth parties, subcontractors, and jurisdictional concentration.
- Assuming a SOC report transfers responsibility to the vendor.
- Having no exit plan or data-return clause.