[Ethan Cole]

A new hosting, support, or AI provider can change security and privacy risks. What should the contract require?

[Jordan Blake]

Accepted answer

Require notice before any material change to a subprocessor or subcontractor, including the service role, data involved, location, effective date, and relevant controls. Give the buyer time to assess the change and define escalation, mitigation, or exit options when the new risk cannot be accepted. Keep the primary vendor accountable for performance. NIST SP 800-161 Rev. 1 treats supplier relationships and dependencies as cyber supply-chain risk.

[Maya Chen]

Community reply

What makes a subcontractor’s material change significant enough to trigger the notice and objection process?

[Author]

Posts