Type: Estate-level
Subject: Estate-level
Decision requested: Reconcile all connected applications against executed agreements and remove any that cannot be covered
Inherent / residual: Critical / High
Control owner: Vendor Management / Legal / Procurement
Context: The platform holds no agreement with third-party application providers; the obligation sits with the organization. Where no agreement can be obtained the decision is removal, which is a business decision rather than a security one.
Risks: R-38 [Critical inherent / Critical residual] Slack holds no business associate agreement with any Marketplace application provider
Open verification: V-02 [Critical] Which of the connected applications have an executed agreement covering the data they actually receive, given that Slack holds no agreement with any Marketplace provider.
Ruling:
Amendment or condition: