Undisclosed Subprocessor in a Critical SaaS Vendor
Helio Bank has 220 active SaaS vendors, 18 designated critical. A new operational-resilience rule requires a complete register of ICT third-party providers, including subcontractors and data flows. Procurement discovers that its marketing-analytics vendor, which processes 400,000 customer email addresses and 14,000 employee survey records, uses a subprocessor in a non-adjacent jurisdiction. The contract is silent on subprocessors, breach notification, and audit rights. The vendor's security questionnaire was last completed two years ago and self-attested. The bank's vendor inventory names only the primary vendor; the data-flow diagram stops at the bank's outbound API. The vendor says the subprocessor only does support and analytics, but logs show raw email content leaving the region. The regulator's first review is in 30 days, and the CISO must decide whether this is a critical-vendor finding or a data-protection issue owned by privacy. The marketing team wants to renew the contract next month.
1. Who should own this finding, and how should it be classified and recorded?
Read the worked answer
This is not an either-or choice between vendor risk and privacy. It is one integrated risk with linked issues: an ICT third-party dependency, a cross-border data transfer, and a contract-control gap. Classify the vendor based on data sensitivity, volume, access, substitutability, concentration, and fourth-party reliance, not just whether it supports a critical service. Four hundred thousand customer email addresses and raw email content make the privacy impact material even if the service is not operationally critical. The CISO should own the ICT third-party risk, the privacy officer should own the data-protection and transfer risk, and the marketing business owner should be accountable for renewing or exiting. The register should record the primary vendor, the subprocessor, the data types, the jurisdictions, the missing contractual controls, and the renewal deadline. A single accountable executive, likely the CISO with privacy co-signoff, should report it. This avoids the common failure where each function assumes the other owns the exposure.
2. What identification evidence should be gathered in the 30 days before the regulator review?
Read the worked answer
Start with the contract and the vendor's subprocessor list, but do not rely on self-attestation. Map actual data flows using gateway, proxy, and API logs; confirm what raw email content leaves the region and where it is stored, processed, and backed up. Obtain the subprocessor's name, jurisdiction, security certifications, breach history, and role. Interview the marketing owner and the vendor about support access, retention, deletion, and onward transfers. Request evidence such as a current SOC 2 report, penetration-test summary, and subprocessor assessment, not just a questionnaire. Review whether the contract gives audit rights, breach notification, data-return and deletion terms, and change-of-subprocessor notice. Update the vendor inventory and data-flow diagram to show the fourth party. Document gaps and interim risk treatment before renewal. For the regulator, produce a register entry that shows the bank knows the dependency, has assessed it, and has an owner and remediation plan, rather than claiming the subprocessor is out of scope.
3. Write a risk statement and three key risk indicators for this vendor.
Read the worked answer
Risk statement: because the marketing-analytics vendor uses an undisclosed subprocessor and the contract lacks subprocessor, breach-notification, and audit controls, raw customer email content may be transferred or accessed without bank oversight, causing a privacy breach, regulatory action, and reputational harm. The statement names cause, event, and impact, and it avoids blaming only the vendor. Key risk indicators: percentage of critical vendors with a complete subprocessor list, percentage of contracts containing breach-notification and audit rights, and number of data flows with raw personal data leaving the approved region. Add a renewal-deadline indicator so the risk does not disappear after the regulator review. Set tolerances and escalation: for example, no renewal without a subprocessor schedule and audit rights, and any cross-border raw-email transfer must have a documented legal basis. These indicators let the CISO track identification completeness, not just incidents, and give the board a measurable view of fourth-party exposure.