Let's cut through the corporate speak. You have a vendor who is stonewalling the OneTrust questionnaire. This isn't a minor inconvenience; it's a critical failure in your third-party risk management program and a direct threat to your compliance posture. If you think this is just about filling out forms, you've already lost.
The vendor's refusal typically stems from one of three root causes, and you must diagnose which one you're dealing with before you can act:
* **Laziness/Resource Constraint:** They see it as a tedious, time-consuming task with no immediate benefit to them.
* **Incompetence:** They genuinely do not understand their own security controls, data handling practices, or compliance obligations. The questionnaire exposes this gap.
* **Malice/Negligence:** They know their practices are deficient or non-compliant, and answering honestly would expose them. Silence is their best defense.
Your current "please and thank you" email chain is a waste of cycles. You need to escalate from a collaborative request to a contractual and business requirement. Here is a concrete workflow, modeled like a deployment pipeline with clear gates.
**Phase 1: Formalize the Demand**
Immediately stop all friendly nudges. Send a final, formal communication that is copied to your internal procurement, legal, and security stakeholders. The message must state, unambiguously:
1. Completion of the OneTrust assessment is a mandatory requirement of the active Master Service Agreement (MSA) or Data Processing Agreement (DPA), citing the specific section (e.g., "Security Audits" or "Right to Assess").
2. Failure to complete the assessment within a defined hard deadline (e.g., 10 business days) constitutes a material breach of contract.
3. All future purchase orders, renewals, and funding releases are contingent on a "Pass" or "Mitigated" status in OneTrust.
4. Outline the consequences: contract suspension, termination, and the initiation of an internal exception process which will flag the vendor to your entire finance and procurement team.
**Phase 2: Execute the Consequences**
If the deadline lapses with no meaningful engagement, you must follow through. This is where most organizations fail.
* **Technical Control:** Engage your cloud/Infra team to immediately restrict the vendor's access. This could mean revoking API keys, disabling service accounts, or firewall rules blocking their IP ranges in your environment. Document this as a security incident.
```terraform
# Example: A quick Terraform to null a vendor-specific IAM role
resource "aws_iam_role" "vendor_access_role" {
name = "vendor-access-role"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Effect = "Deny" # Changed from "Allow"
Principal = {
AWS = "arn:aws:iam::VENDOR_ACCOUNT:root"
}
Action = "sts:AssumeRole"
}
]
})
}
```
* **Business Control:** Instruct Finance to halt all payments. Instruct Procurement to block any new POs. File the formal contract breach notice with Legal.
**Phase 3: The Alternative Path (The Exception)**
Sometimes you cannot terminate a critical vendor. Then you must own the risk entirely, which is a massive undertaking.
You will need to build the evidence yourself, which translates to hundreds of hours of work:
* Demand and manually validate their SOC 2 Type II, pen test reports, and ISO certificates.
* Perform your own infrastructure audit if they provide a cloud service. This means reviewing cloud posture (CIS benchmarks), network diagrams, and data flow maps.
* Model the residual risk in OneTrust as an **exception with compensating controls**. This becomes *your* burden to monitor and report on. Your compensating controls might look like:
* Encrypting all data at rest and in transit before it reaches their platform.
* Implementing aggressive egress monitoring and DLP for data sent to their endpoints.
* Scheduling continuous external vulnerability scans against their public interfaces.
The brutal truth is this: a vendor who refuses assessment is a vendor who is not under control. You either force them into compliance, remove them, or you accept that their risk is now your operational debt. There is no middle ground.
---
Been there, migrated that
Agree completely. You've framed the three failure modes well.
In my experience, it's almost always incompetence disguised as laziness. They don't have the answers, so the path of least resistance is to ignore it.
Your escalation plan is solid. I'd add one concrete metric: start the clock. Give them a hard deadline, then immediately initiate the contractual off-boarding process when they miss it. Document every step. This turns their risk into a clear business decision for your own management.
cost per transaction is the only metric