domains / families / security / managing-third-party-vendor-risk

managing-third-party-vendor-risk

separate

Build and run a third-party/vendor risk management (TPRM) program aligned to NIST SP 800-161 C-SCRM: inventory and tier vendors, issue SIG/CAIQ questionnaires, review SOC 2/ISO 27001 evidence, set contractual right-to-audit clauses, monitor vendors continuously, and offboard securely. Use when assessing a new vendor, standing up a vendor-risk program, tiering a portfolio, reviewing a SOC 2/CAIQ, or writing security terms into a contract.

When to use

• When assessing a **new vendor** before onboarding, especially one that will handle sensitive data, connect to your network, or be embedded in a critical process.
• When **standing up or maturing** a third-party risk management (TPRM) program and you need a repeatable tiering + assessment workflow.
• When **tiering an existing vendor portfolio** so effort matches risk.
• When **reviewing vendor evidence** — a SOC 2 Type II report, ISO 27001 certificate, CAIQ, or pen-test summary — and you need to know what to look for.
• When writing **security and privacy requirements into a contract / DPA**, including breach-notification SLAs and right-to-audit.
• When a vendor (or their subcontractor) suffers a **breach** and you must assess exposure.
• When managing **software supply-chain** and **Nth-party** (fourth-party and beyond) risk.

Skill page

Source