Vendor Risk

The NSA, CISA and Australia’s ASD’s ACSC released vendor-neutral questions to help organizations assess third-party readiness for post-quantum cryptography. Procurement teams can apply them in sourcing, renewals and ongoing vendor assurance to identify cryptographic dependencies and transition risks; the guidance is voluntary, not a solicitation or compliance mandate.

The California Department of Education is reviewing Educational Testing Service’s compliance with contract and data-security requirements after a September breach exposed information belonging to millions of current and former public school students. The review may prompt stronger vendor verification, data-minimization and access-control requirements, as well as dedicated cybersecurity funding; no contract value or new deadline has been announced.

A researcher reported that a publicly accessible CitySourced database contained more than 42 million documents and nearly 450,000 files with residents’ personal information and complaint records. Granicus said the issue was resolved in August, affected customers were notified, and it found no evidence of access by another party—prompting local-government buyers to review vendor security and breach-response requirements.

Microsoft reported a Chinese-linked compromise of SkyKick, the cloud backup service owned by ConnectWise, distinct from the ScreenConnect remote-support product. The incident highlights downstream exposure risks for procurement teams evaluating managed-service and cloud providers with access to organizational systems.

The Federal Reserve Board has issued a new enforcement action against Small Business Bank while terminating previous actions against BNP Paribas entities and Jiko Group, Inc. These developments may alter vendor risk assessments and influence compliance strategies within federal contracting engagements.