vendor-management

name	vendor-management
description	Implement vendor risk management programs. Assess third-party security and maintain vendor inventory. Use when managing supplier security.
license	MIT
metadata	{"author":"devops-skills","version":"1.0"}

Vendor Management

Implement a vendor risk management program covering vendor assessment questionnaires, risk scoring, contract tracking, SLA monitoring, and ongoing oversight for compliance with SOC 2, ISO 27001, and regulatory frameworks.

When to Use

• Onboarding new vendors that will access company data or systems
• Conducting annual vendor risk assessments and reassessments
• Negotiating security requirements in vendor contracts
• Monitoring vendor SLA compliance and security posture
• Preparing vendor management evidence for SOC 2 or ISO 27001 audits

Vendor Risk Tiering

vendor_risk_tiers:
  critical:
    criteria:
      - Processes or stores sensitive/regulated data (PII, PHI, PCI)
      - Single point of failure (no alternative vendor)
      - Has privileged access to production systems
      - Handles authentication or security-critical functions
    assessment_requirements:
      - Full security questionnaire (SIG or custom)
      - SOC 2 Type II report review (or equivalent)
      - Penetration test results review
      - On-site or virtual security assessment (optional)
      - Business continuity and DR plan review
    review_frequency: Annual
    contract_requirements:
      - Data processing agreement (DPA)
      - Business associate agreement (BAA) if PHI
      - Security SLA with breach notification timeline
      - Right to audit clause
      - Cyber insurance requirements
    examples:
      - Cloud infrastructure providers (AWS, Azure, GCP)
      - Identity providers (Okta, Azure AD)
      - Payment processors (Stripe, Adyen)
      - Primary database or CRM SaaS

  high:
    criteria:
      - Accesses significant company data (internal or confidential)
      - Integrates with production systems via API
      - Processes customer-facing transactions
      - Substitution would cause significant business disruption
    assessment_requirements:
      - Security questionnaire
      - SOC 2 report review (Type I or Type II)
      - Compliance certifications verified
    review_frequency: Annual
    contract_requirements:
      - Data processing agreement
      - Security requirements appendix
      - Incident notification clause (72 hours)
    examples:
      - Email/marketing platforms (SendGrid, HubSpot)
      - Monitoring and logging SaaS (Datadog, Splunk)
      - CI/CD platforms (GitHub, GitLab)
      - Customer support platforms

  medium:
    criteria:
      - Limited data access (internal data only)
      - Non-production system integration
      - Some business impact if unavailable
    assessment_requirements:
      - Abbreviated security questionnaire
      - Compliance certification verification
    review_frequency: Every 2 years
    contract_requirements:
      - Standard vendor terms with security clause
      - NDA
    examples:
      - Project management tools
      - HR platforms
      - Travel and expense systems

  low:
    criteria:
      - No access to company data
      - No system integration
      - Easily replaceable
    assessment_requirements:
      - Basic due diligence (public info review)
      - Confirm no data sharing
    review_frequency: Every 3 years or on renewal
    contract_requirements:
      - Standard terms
    examples:
      - Office supply vendors
      - Facilities services
      - General consulting (no data access)

Vendor Assessment Questionnaire

security_questionnaire:
  section_1_governance:
    questions:
      - "Do you have a documented information security policy?"
      - "Is there a designated CISO or security lead?"
      - "Do you conduct annual security risk assessments?"
      - "Do you have a security awareness training program?"
      - "What compliance certifications do you hold? (SOC 2, ISO 27001, etc.)"
      - "When was your last external security audit?"
      - "Do you carry cyber liability insurance? What coverage limits?"
    evidence_requested:
      - Information security policy (or summary)
      - SOC 2 Type II report (or bridge letter)
      - ISO 27001 certificate
      - Cyber insurance certificate

  section_2_access_control:
    questions:
      - "How do you manage user access to systems containing our data?"
      - "Is multi-factor authentication enforced for all personnel?"
      - "How frequently do you conduct access reviews?"
       
       
       
    
         
         
          

  
    
       
       
       
       
       
       
       
       
    
         
        
             

  
    
       
       
       
       
       
    
             
         
          

  
    
       
       
       
       
       
    
          
         

  
    
       
       
       
       
       
       
    
         
         
           

  
    
       
       
       
       
       
    
        
         

Risk Scoring Model

risk_scoring:
  dimensions:
    data_sensitivity:
      weight: 30
      scores:
        1: "No access to company or customer data"
        2: "Access to public or non-sensitive internal data"
        3: "Access to internal confidential data"
        4: "Access to PII or customer financial data"
        5: "Access to regulated data (PHI, PCI, classified)"

    system_access:
      weight: 25
      scores:
        1: "No system access"
        2: "Read-only access to non-production"
        3: "Read/write access to non-production or read-only production"
        4: "Read/write access to production systems"
        5: "Privileged/admin access to production or security systems"

    business_criticality:
      weight: 20
      scores:
        1: "No operational dependency"
        2: "Minor convenience; easily replaced"
        3: "Moderate dependency; replacement in weeks"
        4: "Significant dependency; replacement in months"
        5: "Critical dependency; no viable alternative"

    security_posture:
      weight: 15
      
         
         
         
         
         

    
       
      
         
         
         
         
         

  
     
    
       
       
       
       

  
     
       
          
       
       
        
     

Vendor Registry and Contract Tracking

vendor_registry_schema:
  vendor_info:
    vendor_id: "VND-NNNN"
    vendor_name: ""
    vendor_website: ""
    primary_contact_email: ""
    security_contact_email: ""
    vendor_category: ""  # SaaS, IaaS, Consulting, etc.

  risk_assessment:
    risk_tier: ""  # critical, high, medium, low
    risk_score: 0.0
    last_assessment_date: ""
    next_assessment_date: ""
    assessment_status: ""  # current, due, overdue
    open_findings: 0
    certifications:
      - type: "SOC 2 Type II"
        valid_until: ""
        report_on_file: true
      - type: "ISO 27001"
        valid_until: ""
        certificate_on_file: true

  contract:
    contract_id: ""
    start_date: ""
    end_date: ""
    auto_renewal: 
     
     
    
       
       
       
       
       
       
       
       

  
     []
     
     []
     []

  
     
     
     
     

     
      

SLA Monitoring

"""
Vendor SLA monitoring - Track uptime and response time commitments.
"""
import requests
from datetime import datetime, timezone


class VendorSLAMonitor:
    def __init__(self, vendors_config):
        self.vendors = vendors_config

    def check_uptime(self, vendor):
        """Check vendor service availability."""
        results = []
        for endpoint in vendor.get("health_endpoints", []):
            try:
                resp = requests.get(
                    endpoint["url"],
                    timeout=endpoint.get("timeout", 10),
                    headers=endpoint.get("headers", {}),
                )
                results.append({
                    "endpoint": endpoint["url"],
                    "status": resp.status_code,
                    "response_time_ms": resp.elapsed.total_seconds() * 1000,
                    "healthy": resp.status_code == endpoint.get("expected_status", 200),
                    "timestamp": datetime.now(timezone.utc).isoformat(),
                })
            except requests.RequestException as e:
                results.append({
                    "endpoint": endpoint["url"],
                    "status": "error",
                    "error": str(e),
                    "healthy": ,
                    : datetime.now(timezone.utc).isoformat(),
                })
         results

     ():
        
        status_url = vendor.get()
          status_url:
             
        :
            api_url = 
            resp = requests.get(api_url, timeout=)
            data = resp.json()
             {
                : vendor[],
                : data.get(, {}).get(, ),
                : (data.get(, [])),
                : [
                    {: c[], : c[]}
                     c  data.get(, [])
                ],
            }
         Exception:
             {: vendor[], : }

     ():
        
        total = (monthly_checks)
        healthy = (  c  monthly_checks  c.get())
        uptime_pct = (healthy / total * )  total >   
        avg_response = (
            (c.get(, )  c  monthly_checks  c.get())
            / (healthy, )
        )
         {
            : vendor_name,
            : datetime.now(timezone.utc).strftime(),
            : total,
            : healthy,
            : (uptime_pct, ),
            : (avg_response, ),
            : uptime_pct >= ,
        }

Vendor Lifecycle Management

vendor_lifecycle:
  onboarding:
    step_1_request:
      - Business owner submits vendor request with use case
      - Procurement assigns vendor ID
      - Initial risk tier assessment based on data access and criticality

    step_2_assess:
      - Send security questionnaire (appropriate to tier)
      - Review compliance certifications
      - Evaluate questionnaire responses
      - Score vendor risk

    step_3_contract:
      - Negotiate security requirements based on risk tier
          
            
         

    
            
            
          
         

  
    
          
            
          
          
    
           
              
          
         

  
    
             
            
          

    
             
            
           
         

    
           
          
            
            

Vendor Management Checklist

vendor_management_checklist:
  program_setup:
    - [ ] Vendor risk tiering criteria defined
    - [ ] Security questionnaire template created
    - [ ] Risk scoring model documented
    - [ ] Vendor registry established
    - [ ] Onboarding and offboarding procedures documented
    - [ ] Contract security requirements defined per tier

  ongoing_operations:
    - [ ] All active vendors cataloged in registry
    - [ ] Risk tier assigned to each vendor
    - [ ] Security assessments current (per tier schedule)
     [ ]       
     [ ]        
     [ ]        
     [ ]     
     [ ]      

  
     [ ]      
     [ ]       
     [ ]     
     [ ]      
     [ ]     
     [ ]       

Best Practices

• Tier vendors by risk before investing assessment effort: not every vendor needs a full security review
• Use standardized questionnaires (SIG, CAIQ, or consistent custom template) for comparable assessments
• Review SOC 2 Type II reports thoroughly, including complementary user entity controls
• Include right-to-audit clauses in contracts for critical vendors even if you do not exercise them frequently
• Monitor vendor status pages and set up alerts for outages affecting your services
• Track sub-processor changes: your vendor's vendor is part of your supply chain risk
• Maintain a vendor registry as a single source of truth for all vendor relationships
• Conduct offboarding rigorously: revoke all access and obtain data destruction certificates
• Score vendor risk quantitatively to enable consistent prioritization and trend analysis
• Report vendor risk metrics to management quarterly as part of the overall risk management program