Vendor Risk

Overview

Vendors may process data, hold credentials, operate infrastructure, deliver software, provide custody, support payments, or influence critical decisions. Their outages, breaches, subcontractors, legal constraints, concentration, and business failure can transfer material consequences to customers.

A questionnaire or certification provides limited assurance and may not reflect the exact service, configuration, or current control operation. Hidden fourth parties, shared infrastructure, remote access, unilateral product changes, and difficult exit paths often create exposure beyond the signed contract.

Organizations should tier vendors by criticality and data access, perform risk-based due diligence, define security and notification obligations, limit privileges, monitor service and control evidence, and test continuity. Exit, data return, credential revocation, migration, and replacement plans should exist before dependency becomes irreversible.

Metrics for Vendor Risk should distinguish coverage, control execution, alerts, confirmed outcomes, losses, false positives, processing time, exceptions, and unresolved actions.

Vendor risk is exposure created when an external provider’s security, operations, finances, compliance, technology, or dependencies affect an organization’s objectives. Vendor risk remains the customer’s risk, requiring evidence, least privilege, contractual clarity, dependency visibility, monitoring, continuity, and a workable exit.

For Vendor Risk, the assessment should evaluate exposure created when an external provider’s security, operations, finances, compliance, technology, or dependencies affect an organization’s objectives. The assessment record should separate observed evidence supporting exposure created when an external provider’s security, operations, finances, compliance, technology, or dependencies affect an organization’s objectives from assumptions, state the time horizon and existing controls, and identify who owns any remaining exposure. Monitoring should test whether the conditions described in exposure created when an external provider’s security, operations, finances, compliance, technology, or dependencies affect an organization’s objectives have changed enough to require a new rating, treatment, or approval.