The Vendor That Failed Its Own Audit

No - the bridge letter does not satisfy the policy as written. The policy requires a current Type II report with no material exceptions. What exists is a 14-month-old report with a qualified opinion on a control that has now failed a second time. A bridge letter is the vendor's own assertion; it is not an independent audit opinion, and it is precisely the kind of self-attestation that a second failure undermines.

Residual risk:

• Control efficacy: key rotation failed twice. The first failure was in the audited window; the second was last month. That pattern suggests the control is not reliably operating, not that it had a one-off lapse.
• Detection: the second lapse was found internally and not disclosed to customers. That means the payments company's visibility into the vendor's control health depends entirely on the vendor's willingness to tell it - and the vendor has demonstrated a narrow reading of "material."
• Contract gap: "material security incident" is undefined, so the vendor can plausibly argue a contained key-rotation lapse is not material. Whether that is right depends on the data and exposure, which the payments company cannot assess because it wasn't told.

Conclusion: the vendor is out of policy. The reassessment must treat this as a finding, not a formality.

Do not simply renew with a note. A note documents the risk without changing it; if the control fails again and data is exposed, the note is evidence that the company knew and did not act.

Actions within 30 days:

1. Escalate the second lapse to the vendor in writing, and demand the incident details: what data was in scope, what the exposure window was, and why it was not notified. The 72-hour clause is only meaningful if invoked.
2. Require a current Type II (or a focused attestation on key management) rather than accepting the bridge letter. If the vendor cannot produce one, that is a finding.
3. Tighten the contract: define "material security incident" to include any control failure affecting encryption or key management, with a notification deadline and a right to audit.
4. Compensating controls on your side: verify encryption at rest independently, restrict the vendor's access to keys, and monitor for anomalous access.
5. Document the risk acceptance with a named owner and a review date - if the business chooses to continue, that decision must be explicit and owned, not buried in a reassessment form.

Risk of renew-and-note: it converts a live control failure into a paper trail of inaction, and it leaves the company dependent on a vendor that has already shown it will not volunteer bad news.

The argument is plausible but not sufficient, for three reasons.

1. "Not confirmed exposed" is not "not exposed." A key-rotation lapse means the exposure window existed; whether anyone used it is a separate question that may be unanswerable. Absence of evidence of exposure is not evidence of absence.
2. Materiality is not the vendor's alone to decide. The contract's notification clause exists so the customer can assess materiality against its own data, regulators, and obligations. A vendor that self-determines materiality and stays silent has effectively taken the customer's decision away. The right design is notify-then-assess, with a low threshold, not assess-then-maybe-notify.
3. Pattern matters. This is the second failure of the same control. Even if each individual lapse is immaterial, the recurrence is material to the control's reliability - and reliability is exactly what the SOC 2 opinion was qualified on.

What to do with the argument: reject it as a basis for non-notification, but engage with it on the facts - ask for the exposure window, the scope, and the detection method. Then fix the contract so the question does not recur: define materiality to include any key-management control failure, and require notification within 72 hours regardless of confirmed exposure.