A security architect is reviewing a third-party SaaS provider contract. The provider will process regulated financial data on behalf of the organization. Which risk management concern is MOST critical to address before signing?

Question

Accepted Answer

B. Assessing the provider's third-party risk and data handling practices. Third-party risk management is a core CAS-005 V5 objective. When a vendor processes regulated data, the organization must assess the provider's security posture, data handling practices, contractual controls (e.g., right to audit), and compliance with applicable regulations before signing. Uptime SLA and MFA are important but secondary to understanding the full risk exposure introduced by the third party.

A security architect is reviewing a third-party SaaS provider contract. The provider will process regulated financial data on behalf of the organization. Which risk management concern is MOST critical to address before signing?

Related Questions

Discussion