[Priya Shah]

When a primary vendor relies on cloud, analytics, support, or AI providers that also handle buyer data, what controls are useful?

[Maya Chen]

Accepted answer

Require a current subprocessor list that includes purpose, data categories, location, and service role. Define advance notice for material changes, a review or objection process, equivalent security and privacy obligations, incident cooperation, deletion, and vendor accountability for subcontracted work. Focus on the data path and risk, not just the number of suppliers. NIST SP 800-161 Rev. 1 treats supplier relationships as part of organization-wide cyber supply chain risk.

[Jordan Blake]

Community reply

How much time should a buyer have to object before a new subprocessor starts handling data?

[Author]

Posts