When Oracle Health reported that its legacy Cerner breach affected about 20 million people, the questions started flooding TPRM Slack channels and team standups. Not the polished, formal questions you'd see in a compliance audit, the real ones. The "wait, how do we even audit this?" and "does our contract cover legacy systems they haven't migrated yet?" questions.
Here's what practitioners are asking right now, with answers you can actually use.
Understanding the Source of These Questions
The Oracle Health breach involved stolen credentials accessing legacy Cerner servers not yet migrated to Oracle Cloud. The breach began as early as January 22, 2025, but went undetected until February 2025. What makes this particularly challenging for risk teams is that dozens of healthcare systems only learned their patient data was compromised when Oracle finally sent breach notices months later.
This isn't a theoretical scenario anymore. It's a vendor incident your leadership is asking you to prevent.
Q1: How Do I Know If My Critical Vendors Are Using Legacy Systems?
Ask directly in your annual reassessment. Add a specific question to your SIG Core supplement: "List all systems containing our data that are scheduled for migration or decommissioning in the next 24 months, including target completion dates."
Then verify it. Your Right to Right to Audit should let you request architecture diagrams showing where your data lives. If a vendor acquired another company (like Oracle acquiring Cerner in 2022), that's your trigger to dig deeper. Acquisitions create legacy system backlogs.
Don't accept "we're in the process of migrating" without a timeline. You need to know which systems, what data, the completion date, and who's accountable if the timeline slips.
Q2: Can I Require a Vendor to Accelerate Their Cloud Migration Timeline?
Not unilaterally, but you've got leverage points.
First, check your contract for material change clauses. If the vendor's security posture has degraded (legacy systems are inherently higher risk), you may have grounds to renegotiate terms or invoke enhanced monitoring rights.
Second, use Criticality Classification to your advantage. If this vendor supports Critical or Important Functions under your framework, you can require compensating controls while legacy systems remain active: enhanced credential management, segmented network access, more frequent penetration testing.
Third, tie renewals to migration completion. When you're negotiating your next contract term, make cloud migration a condition precedent. No migration, no renewal, or at minimum, a material price reduction to offset your increased risk.
Q3: What Detection Gap Should I Close on My Vendor's Infrastructure?
You can't monitor their internal networks, but you can contractually require specific Notification Timelines. Your contract should mandate notification within 24-48 hours of detection, not discovery of full impact.
The Oracle incident highlights why "upon discovery" language fails you. Vendors will wait until they've completed forensics. You need notification triggered by initial detection of unauthorized access to systems containing your data.
Also require monthly attestations that no security incidents affecting your data have occurred. It won't prevent breaches, but it creates a regular forcing function for vendors to check their logs and creates liability if they attest falsely.
Q4: What Credential Management Practices Should I Be Auditing?
Start with privileged access management (PAM) for any system touching your data. Your vendor should be using:
- Multi-factor authentication for all privileged accounts
- Credential rotation every 90 days maximum for service accounts
- Just-in-time access provisioning
- Session recording for privileged access
During your next assessment, request evidence: screenshots of their PAM configuration, logs showing MFA enforcement, and their access review schedule. If they can't produce this in 48 hours, that's a control gap.
For Business Associates under HIPAA, you're not just asking nicely. HIPAA's Security Rule (§164.308(a)(3)) requires you to implement procedures for granting access to ePHI. If your Business Associate can't demonstrate these controls, you're both exposed.
Q5: How Do I Prioritize Which Vendors to Pressure About Legacy Systems?
Use a two-factor filter: data sensitivity and vendor age.
First, identify which vendors process protected health information, financial data, or personally identifiable information at scale. Those go in tier one.
Second, filter for vendors who've been acquired in the last five years or who've publicly announced cloud migration initiatives. Acquisitions create integration debt. Public cloud commitments create timelines you can hold them to.
If a vendor checks both boxes, they're processing sensitive data and they're mid-migration, that's where you focus your next Right to Audit exercise.
Q6: Does Litigation Change How I Manage This Vendor Relationship?
Litigation creates two risks for you: distraction and financial viability.
Distracted vendors miss SLA commitments and delay security improvements. Build this into your Continuous Monitoring of Active Arrangements. If your vendor is named in material litigation, increase your touchpoint frequency. Monthly calls instead of quarterly.
Financial viability matters if the lawsuits result in significant settlements. Run a Going Concern Assessment. Review their latest financial statements, check for litigation reserves, and monitor their credit rating. If you're dependent on this vendor for Critical or Important Functions, you need a Wind-Down Plan that assumes they might exit the market or get acquired under duress.
Q7: How Do I Track the Real Scope of a Vendor Breach?
You can't rely on vendors to tell you. Set up Google Alerts for your critical vendors + "data breach" and "attorney general." State AG offices often publish breach notifications before vendors update their national counts.
Also monitor the HHS HIPAA Breach Reporting Tool directly if you're in healthcare. The Oracle breach was initially listed at 501 patients and eventually grew to about 20 million. That's not a rounding error, that's a vendor managing disclosure strategically.
Your Vendor Breach Management protocol should include independent verification. When a vendor reports a breach, assign someone to check state AG sites and federal reporting tools weekly for 90 days.
Q8: What's the One Control I Should Implement This Quarter Based on This Breach?
Require migration timelines in your next contract negotiation.
Add this clause: "Vendor shall provide written notice within 30 days of any decision to delay, pause, or extend the timeline for migrating systems containing Customer data to [specified secure environment]. Customer reserves the right to conduct an extraordinary assessment at Vendor's expense if migration timelines extend beyond [agreed date]."
It won't prevent every breach, but it forces vendors to treat legacy system risk as a contractual obligation, not an internal IT project they can quietly delay.
Next Steps
If you're managing healthcare vendors specifically, review the HIPAA Security Rule's access control requirements (§164.312(a)(1)) and audit your Business Associate Agreements for specificity around system migration obligations.
For broader vendor portfolio management, ISO 27036 provides a framework for managing information security in supplier relationships, including how to handle system transitions and technology refresh cycles.
And if you're dealing with vendors who've been acquired, treat the acquisition date as a trigger for extraordinary reassessment, not just annual review. That's where the legacy system risk hides.
