Discovering a vendor is using a non-compliant subcontractor is a significant third-party risk event that constitutes a breach of policy and likely the contract. The best approach is to follow a structured, formal process. This involves invoking the organization's incident management plan to assess the immediate risk, formally notifying the vendor of the breach, and demanding a remediation plan as stipulated in the contract. This ensures the issue is documented, tracked, and resolved in a legally and operationally sound manner, protecting the organization while holding the vendor accountable. Immediate termination without investigation can introduce legal and operational risks.

(Based on inferred standard options)

A. Immediately terminate the contract: This is a drastic step that may cause service disruption and could violate contractual terms for remediation periods.

B. Allow the use to continue: This ignores a known policy violation and accepts an unmitigated risk, potentially violating regulatory or client requirements.

C. Report to regulatory authorities first: This is premature. The first step is to investigate and work with the vendor to remediate the issue per the contract.

1. Shared Assessments. (2023). Standardized Information Gathering (SIG) Questionnaire. Domain: N-th Party Management. This section explicitly covers the requirement for third parties to adhere to contractual obligations regarding their own vendors (subcontractors), including location and security requirements.

2. Shared Assessments. (2022). Managing Nth Party Risk. White Paper. This paper outlines best practices for handling risks from subcontractors, emphasizing contractual controls, monitoring, and having a process for addressing non-compliance. Section: "Remediation and Ongoing Monitoring."