In short
Fourth-party risk is the risk arising from a vendor's own vendors, such as the cloud provider used by a payroll service, which the organization has no direct contract with.
Key takeaways
- It is managed through contract terms requiring vendors to oversee and disclose their key subcontractors.
- Carve-out reports leave subservice organizations' controls outside the report's scope.
- Concentration risk arises when many vendors depend on the same provider.
Where it's tested
ISC: Third-Party & Vendor Risk — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
A service organization's SOC 1 report uses the carve-out method for a subservice organization. What does this mean for the user entity?