Home / Knowledge hub / Vendor risk management
Knowledge hub
Vendor risk management
Judging and monitoring the security of the suppliers your business relies on.
What it means
Vendor risk management is the habit of deciding which suppliers you can trust with your data and systems, and checking that this stays true. It covers cloud hosts, payment providers, support tools, contractors and anyone else who can touch what matters to you.
It runs in stages: list the vendors, rank them by what they can reach, ask for evidence, agree contract terms, review on a schedule, and plan how to leave. Standards often call the wider topic third-party or supplier risk, and the same steps apply to a one-person contractor.
Why it matters
When a vendor is breached, your customers' data can go with it, and you still answer for it. A small tool with wide access can be a bigger risk than a large vendor with narrow access. A vendor breach is also rarely announced to you quickly. Your own security work counts for less if a supplier's weak sign-in lets someone in.
Buyers and auditors ask about it too. Frameworks such as ISO 27001 and SOC 2 both expect you to manage suppliers, and your own enterprise customers will send a security questionnaire about yours, often before they agree to sign. Having a clear answer ready shortens that sales conversation.
How it shows up
In practice it means a register of vendors with the data each one holds, a tiering of high, medium and low, and a review that fits the tier. A high-risk vendor might supply a SOC 2 report, a recent pentest summary and proof of incident handling. A low-risk one might need only a short form.
The mistakes repeat. The list is stale, so shadow tools sit outside it. Questionnaires are collected and never read. Access granted at the start is never removed when the contract ends. Check what each vendor can reach today, and who in your team owns the relationship.
Questions people ask
Vendor risk management, answered
Is vendor risk management the same as supply chain security?
They overlap. Vendor risk management is the business process of judging and monitoring suppliers. Software supply chain security is narrower and technical, covering the code, packages and build systems you depend on.
Do we need a questionnaire for every vendor?
No. Rank vendors by what they can access and how bad a failure would be. Send detailed questions to the few that hold sensitive data or critical functions, and use a lighter check for the rest.
Is a SOC 2 report enough to trust a vendor?
It is useful evidence, not a guarantee. Read its scope, the period it covers and any exceptions noted, and check that the systems you use are inside it. A report that excludes your service tells you little.
What is fourth-party risk?
It is the risk from your vendors' own suppliers. You rarely have a contract with them, so ask your vendors who they depend on and how they manage that. Fourth-party risk is a common blind spot.
When should we review a vendor again?
On a schedule that fits the tier, often yearly for high-risk vendors. Also review after a breach, a change of ownership, a major service change or a lapse in their certifications.
Related
Terms that sit next to this one
Security vendor assessment
Checking a supplier's security before you trust them with your data.
Fourth-party risk
The risk that comes from your suppliers' own suppliers.
Security questionnaire
The list of questions a buyer's security team sends before they sign.
Third-party script risk
Code from outside vendors running on your pages with the same powers as yours.
Supply chain attack
Reaching you through a library, a build tool or a vendor you trust.
What can your vendors reach?
If you are the vendor, buyers will ask for proof that your own application holds up. We can give you findings with evidence you can show them, and a retest that confirms fixes. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.