Elena, a Vendor Risk Manager, is auditing a prospective AI translation provider. The primary vendor has flawless security credentials and encrypts…

Elena's critical finding is that data is being processed by undisclosed fourth parties (the linguistic specialists). This introduces a significant blind spot in the data supply chain, creating security, compliance, and privacy risks. Her immediate priority is to identify all entities that have access to the data to understand the full scope of the risk. The question "Who else touches the data?" directly targets this gap in the vendor's disclosure and contractual obligations.

A. While a valid concern, the immediate issue Elena flagged is about undisclosed data handlers, not the vendor's internal model training practices.
C. Data export capabilities relate to vendor lock-in and data portability, which is a different category of risk from the one identified in the scenario.
D. Data storage duration is a data retention policy issue. It is an important risk factor but does not address the immediate problem of unauthorized or unknown data access.

1. National Institute of Standards and Technology (NIST). (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). (NIST AI 100-1). Section 4.3.3, "Third Party Risk," emphasizes the need to understand and manage risks associated with third-party software, hardware, and data, including the entire supply chain.

2. MIT OpenCourseWare. (2016). 15.S07 Global Risk Management. Session 10, "Vendor and Third Party Risk Management." The course materials emphasize the importance of due diligence on all third parties and sub-contractors who handle sensitive data.