When a supplier's jurisdiction changes, so does its risk profile. That is a signal the security team should track too.
Sanctions and export control lists are usually treated as legal and procurement work. They have a security counterpart: the jurisdiction of a supplier, or of its subcontractor, determines where your data is processed and which access demands it may be subject to.
Three things security cares about
- Has the country hosting the service that processes your data changed?
- Has the supplier's ownership or subcontractor chain changed?
- Has the development team of software you use moved to another jurisdiction?
How to track it
A contractual obligation to declare subcontractors is the cheapest method. From outside, these help: changes in the service's DNS and hosting records, a change of certificate provider, subdomains moving to a new country code.
The decision threshold
Not every change needs an action. Write the threshold up front: for systems handling critical data a jurisdiction change triggers review; elsewhere it is simply recorded.
