When a vendor falls short, you have five options: ask for a fix, narrow how you use the product, add a control on your side, formally accept the risk with named sign off, or decline. Pick the one that fits the size of the gap and how much you need the product.
The five options
| Option | When it fits | What it requires |
|---|---|---|
| Ask for a fix | The gap is specific and the vendor is willing | A dated commitment, ideally in the contract |
| Narrow the use | The risk comes from data or access you could withhold | Less data shared, fewer integrations |
| Add a compensating control | The gap is on their side but you can reduce impact | Encryption on your side, network limits, monitoring |
| Accept the risk | The residual risk is low or the need is high | Named owner, written reason, expiry date |
| Decline | The gap is severe or the vendor will not engage | An alternative or a changed plan |
How to choose
Start with two questions. How bad is the worst realistic outcome if this gap is used against you? And how hard is it to replace the vendor? A severe gap with an easy alternative points to declining. A moderate gap in a hard to replace product points to conditions and compensating controls.
Getting a fix that sticks
A promise in an email is weak. Ask for the commitment in writing, with a date, and tie it to something you control, such as the renewal. If the vendor needs time, grant a short limited approval that expires unless the fix is delivered. For contract language, see security exhibit clauses to ask a vendor for.
Accepting risk properly
Acceptance is a decision, not a default. Record these items:
- The gap, in plain words
- The business reason for accepting it
- The person with authority who accepted it
- Any compensating controls
- An expiry or review date
An acceptance with no expiry becomes permanent by neglect. The same discipline applies inside engineering; see vulnerability exceptions and risk acceptance questions.
Declining without burning the relationship
Say what the gap was, what would change your view and when you would look again. Vendors often improve, and the same team may be back in a year with new evidence.
If the vendor is already in use
Treat a failed review of an existing vendor as an incident of a slower kind. Reduce access first, then negotiate, and plan an exit in parallel. See vendor offboarding for the exit steps.
Quick check
Who should be allowed to accept vendor risk?
Someone with authority over the business process the vendor supports, advised by security. Security alone should not carry a business decision.
Can compensating controls replace a missing vendor control?
Sometimes they reduce impact, but they rarely remove the gap. Record what the control covers and what it does not.
Safeguard's policies, gates and compliance evidence automation can help record these decisions, and a free scan is at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
