Which term describes the liability that arises when a subcontractor fails to meet security requirements?

Which term describes the liability that arises when a subcontractor fails to meet security requirements?

• A. Due Care
• B. Downstream Liability
• C. Gap Analysis
• D. Policies

Answer: (B)

Downstream liability is the legal responsibility that arises when a subcontractor fails to meet security requirements. When a vendor or subcontractor doesn’t implement appropriate security controls, the organization that hired them can be held liable by customers, regulators, or other affected parties for not ensuring those controls were in place across the supply chain. This reflects how security duties extend beyond a single entity and can flow along the vendor chain.

Why this fits best: it directly describes who bears responsibility when a third party’s security shortfalls cause harm. The other terms focus on different ideas: due care relates to the expected level of protection rather than chain-of-responsibility liability; gap analysis is a process for identifying where controls are missing; policies are the rules guiding behavior, not a description of who is liable for a subcontractor’s failures.