LastPass Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for LastPass

1. 1

   Request breach remediation documentation within 30 days: Contact LastPass's security team and ask for a written summary of post-2022 architectural and operational security improvements. Their trust center at https://trust.lastpass.com is the starting point; escalate to a direct security contact if documentation is not publicly available.

2. 2

   Obtain and review the SOC 2 Type II audit report: Ask the vendor's compliance or security team for their most recent SOC 2 Type II report (covering at minimum the period post-2022 remediation). Review the report for findings, exceptions, and auditor qualifications — pay particular attention to sections covering access controls, encryption, and incident response.

   SOC 2 Overview (AICPA)NIST Incident Response Guide
3. 3

   Verify ISO 27001 certification independently: Request the ISO 27001 certificate of registration including the issuing certification body name and certificate number. Contact the certifying body directly or use their public certificate lookup tool to confirm current validity and scope.

   ISO 27001 Standard
4. 4

   Conduct manual sanctions screening: Given that automated sanctions screening was unavailable, manually verify LastPass and its parent entity against OFAC's SDN list (https://sanctionssearch.ofac.treas.gov/), the EU Consolidated Sanctions List, and the UN Security Council Consolidated List before finalizing engagement.

5. 5

   Assess master password and vault security policy alignment: Given the confirmed breach history involving vault data, review your organization's LastPass configuration to ensure zero-knowledge principles are enforced — including strong master password requirements, MFA enforcement for all accounts, and review of any shared vault permissions. Reference LastPass's security hardening guide at https://lastpass.com/security.

6. 6

   Confirm LEI registration status: The LEI registration for LASTPASS US LP was in lapsed status as of April 2024. Ask the vendor's legal or finance team to confirm current registration status and, if still lapsed, seek clarification on the reason — this is a low-urgency administrative item but worth resolving before contract execution.

   NIST Cybersecurity Framework

• Sanctions and watchlist screening was unavailable during this investigation. Manual sanctions screening against OFAC, EU, and UN lists is recommended as a compensating control before finalizing vendor engagement.
• The subprocessor discovery tool identified eight entries from the vendor's published subprocessor page at trust.lastpass.com however, several entries appear to reflect navigation or marketing copy rather than identifiable third-party entities, suggesting the published subprocessor list may not be fully structured or complete. Buyers requiring comprehensive GDPR Article 28 subprocessor disclosure should request a formal, structured subprocessor list directly from the vendor.
• External cyber risk scoring was not available for this assessment, which limits the ability to benchmark LastPass's security posture against industry peers on a continuous scoring model.
• The LEI registration for LASTPASS US LP (LEI: 5493000DIFGRN7UVB395) reflects an active legal entity status but a lapsed registration status as of the last update in April 2024. This administrative gap should be noted but does not independently indicate operational or financial distress.