Your glossary for risk and compliance
Helpful definitions of all of the terms you need to know to better manage risk and compliance.
TermsAFSL Authorised Representative AICPA Annex A Controls ASIC Attestation of Compliance (AOC) Business Continuity Management Compliance Automation Software Compliance Risk Management Cybersecurity Maturity Model Certification (CMMC) FedRAMP Governance Risk & Compliance (GRC) GPDR HIPAA HITRUST Incident Management Information Security Management System (ISMS) ISMS Governing Body ISO 27001 Notifiable Data Breach OAIC Policy Management SOC 1 SOC 2 SOC 3 SOC Reports SOC Trust Services Criteria (TSC) SSAE 16 SSAE 18 Third Party Risk Management Vendor Assessment Vendor Management Policy Vendor Review Vulnerability Vulnerability Management
What is a Vendor Management Policy?
A vendor management policy is an important component of an organization's larger compliance risk management strategy. It is a best practice for any organization that works with sensitive data and customers' personally identifiable information (PII) to develop a policy to review all vendors — each third-party, contractor, or associate with whom an organization does business — and to establish requirements for the level of information security that vendors should maintain. As an organization outsources to a wider ecosystem of vendors and partners, its risk increases.
A vendor management policy, developed and overseen by a cross-company team, will help an organization evaluate its current vendors according to level of risk, and to assess potential new vendors for adherence to appropriate cybersecurity practices. A successful vendor management policy will also establish processes for the continuous monitoring of third-party and fourth-party service providers to ensure their ongoing adherence to an appropriate level of security.
Organizations maintaining a vendor management policy may have a particular interest in working with vendors who meet security requirements such as SOC 2 compliance.