Vendor Management Policy

1. Purpose & Scope

This policy governs how [Organization Name] evaluates, contracts with, and monitors third-party vendors and service providers who have access to company systems or data. It applies to any vendor engagement involving data access, system integration, or a dependency on the vendor's own availability or security posture.

2. Definitions

• Vendor / Third Party: Any external entity providing goods, services, or systems to [Organization Name].
• Subprocessor: A third party engaged by a vendor to help deliver the vendor's service, who may also process [Organization Name]'s data.
• Critical Vendor: A vendor classified under the Critical tier per Section 3.
• DPA / BAA: Data Processing Agreement or Business Associate Agreement — the contract governing how a vendor handles regulated data on the organization's behalf.

3. Vendor Inventory & Classification

Every vendor is assigned a criticality tier before the security review starts — the tier decides how deep that review goes, not the vendor's sales rep or contract size.

4. Pre-Engagement Due Diligence

• Security questionnaire completed before signature — a lightweight questionnaire (e.g. SIG Lite) for Moderate tier, a full questionnaire (SIG or CAIQ) for Critical-tier or cloud vendors
• Request current SOC 2 Type II report or ISO 27001 certificate for Critical-tier vendors — a Type I report only proves controls existed on one day, not that they operated over time
• Confirm cyber liability insurance coverage for vendors handling regulated data
• Check references for any new Critical-tier vendor without an established track record

5. Contract & Data Protection Requirements

Before anyone signs, the contract must include, where applicable:

• A DPA (and a BAA specifically, if the vendor will touch PHI) executed before data flows — not after
• Subprocessor authorization terms: the vendor must get authorization before engaging a new subprocessor, and remains liable for that subprocessor's handling of your data
• A breach notification clause with a specific timeline, not just "promptly"
• Right-to-audit or the right to request current compliance certification, for Critical-tier vendors
• Data return or destruction requirements on contract termination

6. Ongoing Monitoring

Reassess each vendor at the cadence set by its tier in Section 3. For Critical-tier vendors, monitor continuously between formal reviews — new subprocessor notifications, security incident disclosures, and compliance certificate renewals should all trigger a look, not wait for the annual cycle.

7. Incident Involving a Vendor

If a vendor discloses a security incident or breach affecting [Organization Name]'s data, treat it as an incident under this organization's Incident Response Plan. Confirm the vendor's contractual notification timeline was met, and document the response for any required downstream notification to your own customers or regulators.

8. Offboarding & Access Revocation

On contract termination, revoke the vendor's access to all systems and confirm data return or destruction per the contract's terms. Document confirmation of destruction for Critical-tier vendors.

9. Roles & Responsibilities

[Procurement / IT / Security] owns the due diligence and classification process. [Legal] owns contract review and negotiation of data protection terms. [Vendor Owner / Business Sponsor] owns the ongoing relationship and is responsible for flagging material changes to how the vendor is used.

10. Exceptions

Any exception to this policy must be documented and approved by [IT/Security leadership], with a defined review date.

11. Policy Review

This policy is reviewed at least annually and following any material change to the organization's vendor landscape or regulatory obligations.