- Area
- Third-Party / Vendor Risk
- Framework
- NIST SP 800-53 Rev 5
- Controls
- SA-9 — External System Services, SR-3 — Supply Chain Controls, SR-6 — Supplier Assessments & Reviews, RA-3 — Risk Assessment
What I did
Assessed a fictional cloud payroll vendor. I sent a SIG Lite-style security questionnaire, reviewed the vendor's SOC 2 Type II report for exceptions and complementary user entity controls (CUECs), scored residual risk, and recommended contract clauses for breach notification and right to audit.
What I learned
A SOC 2 report shifts some responsibility back to you. The CUECs are where most organizations miss their own obligations.