Introduction

A vendor management policy is a way for companies to identify and prioritize vendors that pose a risk to their business.

The policy identifies potentially risky vendors and prescribes controls to minimize risk and ensure compliance with regulatory rules. Vendor management policies are a critical component of an organization’s overall compliance risk management strategy.

The more vendors you work with and share sensitive information with, the more exposed your organization is to security threats. This guide will help you create a Vendor Management Policy for your organization. We suggest that you work with your applicable internal team to assist with the development of the policy. See below for the sections you should include when creating your firm’s policy.

Please note that policies set some parameters for decision-making but leave room for flexibility. They show the “why” behind an action. Procedures, on the other hand, explain the “how.” They provide step-by-step instructions for specific routine tasks. They may even include a checklist or process steps to follow.

Key Elements 

Vendor Management Policies typically include:

• Purpose and Scope
• Roles and Responsibilities
• Risk Types and Definitions
• Vendor Assessment
• Contractual Agreements
• Oversight & Monitoring
• Vendor Termination
• Document Ownership
• Policy Review & Approval

Developing the Policy

Purpose and Scope

Use this section to explain why it's important to have guidelines and standards for selecting and managing vendors throughout their lifecycle.

Also, specify the parties in the organization to whom the policy applies. This description can be brief or detailed, depending on the complexity of your organization. See the example below to get you started:

• Sample Intro. The purpose of this formalized vendor management policy is to provide the [Client name] with a policy that will be followed throughout the organization. A vendor is classified as a third-party company offering something for sale (Please see list of related terms below). The use of third-party vendors creates a true need for monitoring such entities for baseline compliance measures with regard to [Client name] security standards. Specifically, all outsourced processes, procedures, and practices relevant to [Client name] are to be monitored on a regular basis, which includes undertaking various measures on all third parties and providing critical services. Revenue, regulatory, compliance, operational, information technology, and reputational risks are some of the areas that could be affected when using these services. This policy, as well as any relevant procedures, will assist in ensuring the safety and security of the organization, its employees, and its network.

  • The terms “vendors”, “third-party”, “third-parties”, “external parties”, “outsourcers”, “organizations”, and the variant thereof are defined as entities providing outsourcing services to [Client name].

• Sample Scope. Include a list of applicable systems like Internal Systems, External Systems, Users, and any other terms. Include definitions of each (as it applies to your firm), for example: External Systems – resources owned, operated, maintained, and controlled by any entity other than [Client name], but for which these very resources may impact the confidentiality, integrity, and availability and overall security of the internal system resources.

Roles and Responsibilities

Use this section to explain who the policy applies to. It can be as simple as one sentence or more detailed according to the complexities of your organization. See examples below to get you started:

• This policy may apply to some or all of the following: employees, contractors, external parties, etc.

Risk Types and Definitions

Use this section to explain critical risk elements identified by your organization for this policy. Provide a definition for each element and categorize them by level of risk. This description can be brief or detailed, depending on the complexity of your organization. See the example below to get you started:

• Areas of potential risk to consider. please refer to the following areas that should be evaluated when assessing a new vendor:
  • Regulatory Compliance. Evaluate the vendor's compliance with relevant industry regulations and standards to reduce legal and operational risks.
  • Financial Stability. Ensure that vendors have a solid financial standing to fulfill their obligations and maintain a long-term partnership.
  • Reputation. Assess the vendor's track record and reputation in their industry to avoid any potential damage to your brand.
  • Information Security Controls. Verify that security measures and certifications are in place to protect sensitive data and reduce cybersecurity risks.
• Risk Levels. Vendors are assessed based on their risk level, which is determined by their importance to business operations and the type of data they have access to. There are three levels of risk: low, moderate, and critical.
• Sample Copy. Vendors are classified and assessed based on the impact they have on the operations of [Client name]. This evaluation is conducted by categorizing vendors into low, moderate, or critical risk levels, which are subsequently analyzed in accordance with their risk level and criticality for business operations. This process ensures that vendors are assessed comprehensively and consistently, providing a clear understanding of their overall impact on [Client name]’s operations.

Vendor Assessment

Use this section to describe how your company plans to conduct due diligence assessments and vendor selection to mitigate risks by assessing potential vendors.

This description can be brief or detailed, depending on the complexity of your organization. Please find below the suggested due diligence process that we can follow to evaluate our vendors:

• Initial Screening. This will involve performing a basic assessment based on predefined criteria that are relevant to your organization's needs.
• Evaluation. In this step, we will be evaluating vendors using simplified assessments, certificates, and questionnaires. When assessing a vendor, you should consider several factors such as their internal controls to ensure ongoing compliance with regulatory rules, their business continuity plan, the effectiveness of their cybersecurity program, their financial condition, their controls for monitoring The Office of Foreign Assets Control (OFAC) regulations, their risk and privacy policies, their audit reports, reconciling invoices with contracts, their existing physical, technical, and administrative safeguards to protect the security, confidentiality, and integrity of customer information, their insurance policies for effective coverage, their security standards including Payment Card Industry (PCI) policy and certification, and their written ID theft prevention program.
• Risk Evaluation. Based on the evaluation, you should assign risk levels to categorize vendors as low, moderate, or high-risk.
• Decision Making. Finally, you should select vendors based on the evaluation outcomes, emphasizing compliance and security considerations in contracts. Ongoing maintenance and review: Suggest creating and maintaining a list of current vendors to accompany this policy.

Contractual Agreements

Use this section to explain how the results of the vendor assessment determine any required contractual agreements prior to commencing services with each vendor.

The description can be brief or detailed, depending on the complexity of your organization. See examples below to get you started:

• Legal must conduct a thorough review of the contract
• Determine the roles, services, responsibilities, obligations, and expectations from all relevant parties.
• Identify who will approve/sign the contract. For example: legal senior management, audit committee(s), officers, or board of directors for both parties.
• Define financial terms.
• Confirm vendor’s delivery of regulatory compliance audits, security assessments, etc. as needed/requested.
• Required security measures (if beyond what may be standard from the vendor)
• Other items, including, but are not limited to, the following: resolution measures, indemnification, Service Level Agreement (SLA), continuation of services, default, intellectual property, termination procedures etc.

Oversight & Monitoring

Use this section to explain how your organization will have oversight and monitoring for the services provided by each vendor.

It can be as simple as one sentence or more detailed according to the complexities of your organization. See examples below to get you started:

• Sample intro. Where allowed by law, [Client name] should reserve the right to monitor the security controls implemented in order to safeguard [Client name] information assets. The controls may include, but are not limited to procedures, training, policies, hardware, software, and internal and external assessments.
• Provide an outline or checklist of what your monitoring might entail. Sample content for outline/checklist: procedure, responsible party and notes/comments.

Vendor Termination

Use this section to outline your firm's standard for vendor termination and ensure alignment with contractual obligations, security, and regulatory requirements.

This description can be brief or detailed, depending on the complexity of your organization. See the example below to get you started:

• Sample Copy. Following the termination of a vendor, [Client name] will ensure that the termination process is carried out according to its procedures. This will include data retention standards, removal of access rights, confidentiality, legal review if required, and any other necessary steps.

Document Ownership

Use this section to define who in the organization will have ownership of the Vendor Management Policy.

Get as detailed as needed in order to cover specifics that pertain to your organization. See the example below to get started:

• Sample Copy. The CCO is the owner of this document and is responsible for ensuring that this policy is reviewed and updated on a yearly basis.

Policy Review & Approval

Use this section to explain how your organization will structure a regular review of the Vendor Management Policy so it stays current.

Get as detailed as needed in order to cover specifics that pertain to your organization. See the example below to get started:

• Determine a cadence for review of the policy for updates (at least annually is a suggested minimum).
• Keep an audit trail of policy changes and approvals.
• Establish a testing program to test the effectiveness of your policy (in the event you don’t have any incidents but want to ensure the policy is “working.”