vendor-management

1# Vendor Management
2 
3Implement a vendor risk management program covering vendor assessment questionnaires, risk scoring, contract tracking, SLA monitoring, and ongoing oversight for compliance with SOC 2, ISO 27001, and regulatory frameworks.
4 
5## When to Use
6 
7- Onboarding new vendors that will access company data or systems
8- Conducting annual vendor risk assessments and reassessments
9- Negotiating security requirements in vendor contracts
10- Monitoring vendor SLA compliance and security posture
11- Preparing vendor management evidence for SOC 2 or ISO 27001 audits
12 
13## Vendor Risk Tiering
14 
15```yaml
16vendor_risk_tiers:
17  critical:
18    criteria:
19      - Processes or stores sensitive/regulated data (PII, PHI, PCI)
20      - Single point of failure (no alternative vendor)
21      - Has privileged access to production systems
22      - Handles authentication or security-critical functions
23    assessment_requirements:
24      - Full security questionnaire (SIG or custom)
25      - SOC 2 Type II report review (or equivalent)
26      - Penetration test results review
27      - On-site or virtual security assessment (optional)
28      - Business continuity and DR plan review
29    review_frequency: Annual
30    contract_requirements:
31      - Data processing agreement (DPA)
32      - Business associate agreement (BAA) if PHI
33      - Security SLA with breach notification timeline
34      - Right to audit clause
35      - Cyber insurance requirements
36    examples:
37…