Your vendors have vendors. Map subprocessors, convert contract clauses into testable controls, and monitor the chain you cannot see.
45 min 195 XPSkills: Supply chain, Contracts, Monitoring
Brief
You assessed your CRM vendor. Your CRM vendor runs on a cloud host, pipes support tickets through an AI summariser, and stores backups with a replication service you have never heard of. Your data now lives with four companies, and you signed a contract with one of them.
Fourth parties, your vendors' vendors, are where supply-chain incidents actually come from. You cannot contract with them directly, so the whole discipline is indirection: flow-down clauses, disclosure obligations, and monitoring the parts of the chain you can observe.
You will never have a contract with the company that breaches you. Your power is the clause you put in the contract you do have.
Map the chain you cannot see
Start with disclosure: every Tier 1 vendor contract should require a current subprocessor list and notice before it changes. That list is data. Ingest it, diff it, and you have a fourth-party graph that grows itself. Most organisations discover their fourth parties during the incident; a diff of the subprocessor list last quarter would have introduced them earlier.
Watch for concentration: when three of your Tier 1 vendors all disclose the same fourth party, that fourth party is now part of your critical path whether or not anyone approved it.
The fourth party you have never heard of is on your critical path.
Clauses are obligations; obligations become controls
Every vendor contract clause is a promise someone must be able to verify: the right to audit, a 72-hour breach notification, approval before subprocessors change, data deletion on exit. Written into a contract and never tested, a clause is decoration. The GRC engineering move is to convert each clause into a control with an owner, a test, and evidence: audit rights exercised annually, a breach-notice runbook that gets exercised, a change gate that watches the subprocessor feed.
The test also tells you which clauses are worth negotiating. A right-to-audit clause you will never exercise is worth less than a notification window you drill twice a year.
A clause nobody tests is a promise nobody keeps.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: Breached by a company you never hired
Scenario sim+65 XP
Read the brief and answer both questions.
Incident brief
Your email provider suffers a breach. Reading the disclosure, you learn the attacker entered through 'SupportFlow', a ticket-routing service your provider uses. Your vendor risk register has no entry for SupportFlow. Your provider's contract does not require them to tell you who processes your data on their behalf.
Legal's verdict: 'SupportFlow is not our vendor. We had no relationship with them, so there was nothing to assess.' The incident report lists your customer data among what SupportFlow could access.
Term bank, not all of these are right
third partyfourth partysubprocessorinsurer
1.1What is SupportFlow in relation to your company? (two words)
1.2What is the contractual term for an entity that processes data on your vendor's behalf?
Task 2: The clause that was never exercised
Scenario sim+65 XP
Read the brief and answer both questions.
Incident brief
During a contract review you find that every Tier 1 vendor agreement includes a right-to-audit clause, negotiated hard by legal five years ago. Total times exercised: zero. Meanwhile the breach-notification clause, 'vendor will notify within 72 hours', has never been drilled, and during last year's real incident the vendor's notice arrived in a general support inbox that nobody reads on weekends.
Legal calls the contract 'strong'. The incident timeline suggests otherwise.
Term bank, not all of these are right
strong contractright to audittestable controllegal review
2.1Which clause lets you verify a vendor's security claims directly instead of trusting attestations? (three words)
2.2What must every contractual obligation become before you can rely on it? (two words)
Task 3: Approved by nobody, changed by everyone
Scenario sim+65 XP
Read the brief and answer both questions.
Incident brief
Your payroll vendor emails a subprocessor change notice: they are adding an AI summarisation service that will process ticket content, including the employee HR cases your staff file. The notice goes to a distribution list. Thirty days pass. Per the contract, silence constitutes consent.
Three months later, two other Tier 1 vendors disclose the same AI service as a new subprocessor. Nobody has assessed it. Nobody can say how much of the company's sensitive data now flows through it.
Legal is proud of the new vendor contract template: right to audit, 72-hour breach notice, subprocessor change approval, deletion on exit. None of these clauses has ever been exercised, drilled or monitored. Legal calls the template 'strong'.
Build the clause-to-control map: each obligation becomes a control with an owner, a test, and an evidence source, plus the disclosure feed that keeps the fourth-party graph current.
Contract clauses (template v3)
clause 8.1 right to audit, annually, on 30 days notice
clause 8.4 breach notification within 72 hours
clause 9.2 subprocessor changes require approval; notice 30 days prior
clause 11.3 all data deleted within 30 days of termination
clause 12.1 vendor maintains a current subprocessor list (URL)
1
2
3
4
5
6
7
8
9
10
11
12
Checks
Every clause in the fixture is mapped
Each mapping names a test, an owner and evidence
The breach-notice clause drills against a monitored channel
Subprocessor change is a decision, not a countdown to consent
The quarterly fourth-party review surfaced eight lines. Your manager wants 'the ones that can hurt us' ranked for Monday's risk committee.
Some lines are loud and harmless. Some are quiet and structural. Rank the structural ones.
List only the lines that qualify, worst first. Severity is one of: critical | high | medium | low. Add or delete rows as needed.
quarterly supply-chain review notes
C-1 payroll vendor added an AI subprocessor that processes employee HR tickets; not on the disclosed list
C-2 three Tier 1 vendors all disclose the same backup replication fourth party
C-3 breach-notice drill: vendor notice took 92 hours against a 72-hour clause
C-4 the subprocessor list feed was last diffed nine months ago
C-5 a vendor's portal still shows the old brand colours after their rebrand
C-6 the office plant watering service contract auto-renewed
C-7 a Tier 3 vendor's marketing site was unreachable for an afternoon
C-8 legal would like the contract template to be longer
1
2
3
4
5
6
7
8
9
10
11
12
Checks
The right findings are raised
Benign lines are left out
Severity matches the actual exposure
Ranked worst first
Next on your path · Data & Evidence
Data & Evidence Capstone
Design the evidence architecture for one control family end to end: collection, integrity, monitoring, metrics and the auditor's read view.
