Discussion
Open question
- Posts
A new hosting, support, or AI provider can change security and privacy risks. What should the contract require?
Accepted answerRequire notice before any material change to a subprocessor or subcontractor, including the service role, data involved, location, effective date, and relevant controls. Give the buyer time to assess the change and define escalation, mitigation, or exit options when the new risk cannot be accepted. Keep the primary vendor accountable for performance. NIST SP 800-161 Rev. 1 treats supplier relationships and dependencies as cyber supply-chain risk.
Community replyWhat makes a subcontractor’s material change significant enough to trigger the notice and objection process?
- You must be logged in to reply to this topic.