Discussion
Open question
- Posts
When a primary vendor relies on cloud, analytics, support, or AI providers that also handle buyer data, what controls are useful?
Accepted answerRequire a current subprocessor list that includes purpose, data categories, location, and service role. Define advance notice for material changes, a review or objection process, equivalent security and privacy obligations, incident cooperation, deletion, and vendor accountability for subcontracted work. Focus on the data path and risk, not just the number of suppliers. NIST SP 800-161 Rev. 1 treats supplier relationships as part of organization-wide cyber supply chain risk.
Community replyHow much time should a buyer have to object before a new subprocessor starts handling data?
- You must be logged in to reply to this topic.