Which term describes the liability that arises when a subcontractor fails to meet security requirements?

• A. Due Care
• B. Downstream Liability
• C. Gap Analysis
• D. Policies

Answer: (B)

The liability that arises when a subcontractor fails to meet security requirements is downstream liability. In a supply‑chain or outsourcing setup, risk and responsibility flow along the chain from the party that contracts with the customer to the vendors and subcontractors used by that party. If a subcontractor doesn’t implement required security controls and a breach or loss occurs, the primary organization can be held legally or contractually responsible to the customer because it was the entity that contracted the subcontractor and is responsible for ensuring third parties meet the agreed security standards. This concept emphasizes that the impact and accountability move down the line to those further along the chain, often reinforced by contractual flow‑down security requirements and vendor oversight.

Why the other ideas don’t fit: due care describes the level of care a party should exercise to protect information, but it isn’t a term for the direction of liability through the supply chain. Gap analysis is a method to identify where security controls are missing; it helps find issues but doesn’t describe liability flow. Policies are the rules an organization enacts; they guide behavior but are not the term for liability arising specifically from a subcontractor’s failure.