I'm reading about a recent lawsuit filed by Delta Airlines against one of its vendors. Also see Delta Sues Software Provider Over Data Breach and Lawsuits target Delta and vendor for cybersecurity breach.
Delta's position is, the vendor is responsible:
Any liability coming out of that breach, which is minimal, is going to be the responsibility of the vendor, which is 7,” said Delta CEO Ed Bastian in an interview with The Atlanta Journal-Constitution. “We’ve been very clear about that. It was their breach, not ours.
In the software security and risk management fields, we would hold Delta Airlines responsible because Delta is responsible for its supply chain. That is, Delta is responsible for its vendors it chooses. See, for example, NIST SP 800-53A, Assessing Security and Privacy Controls in Federal Information Systems and Organizations, Item SA-12.
Does US law not recognize supply chains and not hold companies responsible for them?
If not, then what stops someone or a corporation from setting up corporations to sidestep requirements, regulation and oversight?
For the second questions, suppose it would cost a company $10 million dollars to implement a particular program. The company determines it wants to give the money to share holders instead, so they setup an overseas corporation and pays the overseas company $100,000 a year to do the job it was supposed to be doing. It does not matter how poor a job the overseas company is performing since the goal is to offload risk and minimize cost, not comply.