Snowflake Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Snowflake

1. 1

   IMMEDIATE (within 7 days) — Enforce MFA on all Snowflake accounts: Log into your Snowflake Admin Console, navigate to Security > Authentication Policies, and confirm multi-factor authentication is mandatory for every user and service account. This directly addresses the attack vector exploited in the 2024 breach campaign.

2. 2

   IMMEDIATE (within 14 days) — Verify TLS certificate renewal: Confirm with your Snowflake account manager that the snowflake.com certificate (expiring ~May 5, 2026) is being renewed. Re-check status at [SSL/TLS analysis service](https://www.SSL/TLS analysis service.com/ssltest/analyze.html?d=snowflake.com) within two weeks.

   SSL Labs Test
3. 3

   SHORT-TERM (within 30 days) — Obtain SOC 2 Type II report: Request Snowflake's current SOC 2 Type II report directly from their security team or via [trust.snowflake.com](https://trust.snowflake.com/). Confirm the report covers the current period and request a bridge letter if the most recent report is older than 6 months. This is required to close the SOC 2 audit chain for your own CC9.2 compliance.

   SOC 2 Overview (AICPA)
4. 4

   SHORT-TERM (within 30 days) — Obtain complete subprocessor list: Contact Snowflake's privacy team at the address listed in their DPA to request the current subprocessor list in writing. Reference your GDPR Article 28 rights if applicable. Document receipt and review the list for any subprocessors presenting their own risk concerns.

   GDPR Full TextDPA Template (GDPR Art. 28)
5. 5

   SHORT-TERM (within 30 days) — Review Snowflake access and audit logs: Examine query history, data export logs, and login events from your Snowflake environment for the June–September 2024 breach window. Use Snowflake's ACCOUNT_USAGE schema (LOGIN_HISTORY, QUERY_HISTORY, ACCESS_HISTORY views) to identify any anomalous access patterns.

6. 6

   MEDIUM-TERM (within 60 days) — Document complementary user entity controls (CUECs): If Snowflake is in scope for your SOC 2 audit boundary, document the controls your organization is responsible for implementing (e.g., access provisioning/deprovisioning, MFA enforcement, data classification, encryption key management). Share this documentation with your SOC 2 auditor as CC9.2 evidence alongside this report.

   SOC 2 Overview (AICPA)
7. 7

   MEDIUM-TERM (within 60 days) — Clarify AI data handling practices: Submit a written inquiry to Snowflake's privacy team asking specifically: (1) Does Snowflake train AI/ML models on customer data? (2) What is the retention period for data processed by Snowflake AI features (Cortex, etc.)? (3) Is there an enterprise opt-out mechanism? Reference their [privacy policy](https://www.snowflake.com/en/legal/privacy/privacy-policy/) and request a written response for your records.

8. 8

   ONGOING — Monitor litigation developments: Set a Google Alert for 'Snowflake securities lawsuit' and 'Snowflake SNOW class action' to receive updates on the active securities fraud litigation. Reassess vendor risk tier if material adverse judgments or settlements are announced.

   NIST Supply Chain Risk (SP 800-161)

• External cyber risk scoring for snowflake.com was not available during this assessment — no quantitative cyber risk score could be compared against the SaaS industry benchmark.
• Certificate Transparency log data from Certificate Transparency service was unavailable; subdomain enumeration relied solely on direct TLS handshake data, which may underrepresent the full certificate footprint.
• The subprocessor page at trust.snowflake.com/subprocessors was accessible but returned no parseable subprocessor entries, possibly due to dynamic JavaScript rendering; the actual subprocessor list may be more complete than this assessment reflects.
• AI data usage policy signals (training commitment, retention policy, opt-out availability) were not explicitly stated in the crawled privacy policy — the policy page may contain relevant language that was not surfaced by the automated scan.
• The Legal Entity Registry legal entity match returned a low-confidence result (disambiguation score 30/100) linking to a German entity (Wisdom Motor Europe GmbH) rather than Snowflake Inc. — no authoritative LEI record for Snowflake Inc. was confirmed.
• ISO 27001 certification status returned 'not_found' via the IAF CertSearch registry; this may reflect registry incompleteness or search limitations rather than confirmed absence of certification — manual verification with the vendor is recommended.
• Web archive data indicated a first-indexed date of February 2025 for snowflake.com, which is inconsistent with the domain's 1995 registration date — this reflects a limitation of the archive source used rather than actual domain history.
• Securities fraud class action lawsuits referenced in adverse media are at early legal stages; final determinations, settlements, or dismissals are not yet reflected in available evidence.