Vendor Management

Implement a vendor risk management program covering vendor assessment questionnaires, risk scoring, contract tracking, SLA monitoring, and ongoing oversight for compliance with SOC 2, ISO 27001, and regulatory frameworks.

Vendor Risk Tiering

Illustrative policy defaults, not regulatory requirements or automatic vendor classifications. Tier the actual data flows/access/criticality: HR and expense systems can hold highly sensitive data and must not be assigned Medium just by product category. Deadlines, DPAs and BAAs depend on applicable law/role/contract; 72 hours is not a universal vendor notice rule. Have qualified owners determine obligations. Request minimal redacted evidence through approved channels; restrict report/employee/contact data. SOC 2 is an attestation report, not a certification; review scope, period, exceptions, subservice organizations and complementary controls rather than counting badges.