The canon · Security · SEC-5.1

Confirm the retention period applied to insurer nonpublic information after contract termination.

This is one of the twenty-five questions a carrier reviewer sends a vendor, in the words an examiner uses. Below it: the answers that make a reviewer stop on this item, derived by running Vaulith's rules engine on an estate that gets everything wrong, and the free questions that reach it.

What stops a reviewer here

One finding reaches this item.

Will stop the reviewR-SUBPROCESSOR · degrades this item

No subprocessor or sub-model register

One model (MDL-001 Claims triage) runs on a third-party provider that is not named in any approved record. "A leading commercial provider" is not an answer a reviewer can write down. The carrier has to name every third party in its own examination response, so an unnamed provider makes your gap their finding, and a reviewer who cannot close a question in their own file will stop and ask rather than accept it.

To fix: Name every model provider, hosting region, and data processor that touches insurer data, with contract reference and an accountable owner. A single approved table is enough, as long as it is kept current.

How it is scored

Credit per verdict, times the weight.

A contextual item carries weight 1. A pass earns 1.00 of it, a questioned answer 0.60, an escalated one 0.20 and a stop 0.00. An unanswered item earns nothing and still takes the citation penalty, so a profile cannot be improved by leaving an inconvenient question blank. The whole arithmetic is shown on the homepage and in every assessment.

Try it in ninety seconds

The free snapshot asks about this.

Nine questions, free. See what they stop on.