Third-party and vendor risk management, proportionate to vendor access

Tiering rests on two questions: what can the vendor reach, and what stops if the vendor fails. Inputs include the type and volume of data handled, whether the vendor holds credentials or network access into your environment, whether it supports a critical business function, and how hard it would be to replace. A payroll processor or a managed service provider with administrative access sits in the top tier. A supplier with no data and no access needs little beyond a contract clause.

Assessment depth follows the tier. Low tiers get a short review of existing assurance: an ISO 27001 certificate read with its scope statement, or a SOC 2 report read for exceptions and for the controls left to you. Middle tiers answer a questionnaire cut down to the services they provide. Top tiers add evidence requests, architecture discussions and, where the contract allows, technical validation such as penetration testing of the integration. Verification increases with the access involved.

Clauses worth having for higher tiers include the security standard the vendor must maintain, breach notification with a defined deadline and contact, the right to audit or to receive independent assurance reports, notice or approval of subcontractors, data location, return and deletion of data at exit, and cooperation during incidents. Requirements scale down for lower tiers. We draft the security schedule and review vendor paper alongside your legal counsel. Legal advice remains with your lawyers.

Point-in-time assessments age quickly, so high-tier vendors are watched between reviews. Sources include external attack surface observation, breach and leaked-credential reporting from threat intelligence, expiry dates on certificates and assurance reports, and news of ownership or service changes. Defined triggers, such as a disclosed breach or a change in the data handled, start an out-of-cycle reassessment. Lower tiers are reassessed at contract renewal. Findings feed the same risk register as your internal risks.

Each framework asks for the same core practice. ISO 27001 Annex A covers supplier relationships in controls 5.19 to 5.23, including supplier agreements, the ICT supply chain and cloud services. SOC 2 addresses vendor risk under criterion CC9.2. DORA requires financial entities in the EU to keep a register of ICT third-party arrangements, include specific contract provisions and plan exit strategies. We align the program to the frameworks that apply, so one vendor file serves each audit. See compliance frameworks.