Why is vendor risk a concern in cloud governance?

• A. It's identical to internal risk.
• B. It's not a concern.
• C. It only affects marketing.
• D. Because cloud involves external providers; governance must manage vendor risk as part of multi-tenant environment.

Answer: (D)

Vendor risk matters in cloud governance because cloud services rely on external providers to deliver infrastructure, platforms, or software. This means third-party risk is introduced—the organization doesn’t control all security practices, data protections, or incident responses directly, and subcontractors or data handlers within the provider’s ecosystem can impact confidentiality, integrity, and availability. In a multi-tenant cloud environment, resources are shared among many customers, so weaknesses or failures at the provider can ripple to affect your organization’s operations and risk posture. Governance must specify how the vendor protects data, how incidents are managed, what audits and contractual protections are in place, and how access and continuity are handled across the provider’s ecosystem. That’s why managing vendor risk is a fundamental part of cloud governance, rather than treating it as irrelevant or limited to unrelated areas like marketing.