Overview

This skill helps you manage third-party vendor security risks by building a formal assessment process, maintaining a vendor inventory, and enforcing security requirements across contracts. It emphasizes tiered risk assessments, ongoing monitoring, and incident notifications to protect data and operations.

How This Skill Works

A vendor-management program catalogs all vendors, classifies them by risk tier, and runs assessments (security questionnaires, SOC 2 reviews, and penetration tests). It then codifies security requirements in contracts, data processing agreements, and SLAs, and implements continuous monitoring with annual reassessment and incident-notification processes.

When to Use It

• Onboarding a new vendor with access to sensitive data
• Reassessing high- or critical-risk vendors using questionnaires, SOC 2, and pen tests
• Contracting with vendors to include security terms, DPAs, and SLAs
• Setting up ongoing monitoring and annual reassessment cycles
• Responding to a vendor security incident or planning an exit strategy

Quick Start

1. Step 1: Catalog all vendors and classify them by risk tier
2. Step 2: Conduct security assessments (questionnaire, SOC 2, pen tests) and set contract terms (security requirements, DPA, SLAs)
3. Step 3: Establish ongoing monitoring, annual reassessment, and incident-notification processes

Best Practices

• Tier-based assessments
• Regular reassessment
• Contract security terms
• Incident notification requirements
• Exit strategy planning

Example Use Cases

• Catalog all vendors and assign risk tiers to prioritize assessments
• Run security questionnaires and review SOC 2 reports for a critical vendor
• Add security requirements, a data processing agreement, and SLAs to vendor contracts
• Enable continuous vendor monitoring and conduct annual reassessments
• Prepare an exit plan and termination procedures for a vendor

Frequently Asked Questions