Blog · Vendor management · Problem 10 of 93
The buyer asked how you vet your vendors. You use forty and checked none.
· 3 min read · By Case Jones
A customer’s questionnaire has a section on third parties: which vendors touch our data, how we chose them, when we last reviewed them. You pay for dozens of tools, and nobody has looked at their security since the day someone put in a card number.
What it costs to leave it
Your vendors are part of your security. If a tool that holds customer data is breached, the customer sees it as your breach. A buyer who gets a blank or vague answer here will assume the rest of your answers are just as thin, and some contracts require you to name your subprocessors.
How to get vendor management in place in a week
You don’t need a procurement department. You need a list, a way to sort it, and a habit of looking again.
- 1
List every vendor, starting from the money
Export a year of card and invoice payments. Every recurring charge is a vendor. Add the free tools people signed up for with a work email, and anything your product calls out to: hosting, email delivery, payments, analytics, support desks.
- 2
Mark which ones touch customer data
For each vendor, write down what data it sees: none, internal only, or customer data. The ones that hold or process customer data are your subprocessors. They are the ones buyers ask about, and usually a short list.
- 3
Review the subprocessors first
For each one, keep what you checked: their security page, their SOC 2 report or ISO certificate if they share it, the data processing agreement you signed, and whether your accounts use multi-factor authentication. A short note per vendor is enough.
- 4
Give each vendor an owner and a review date
Someone on the team owns each vendor. Customer-data vendors get looked at once a year, or when they change something important. Put the date in the list so it actually happens.
- 5
Write the rule down
A one-page vendor management policy says how you choose vendors, what you check before customer data goes to one, and how often you review. It’s what the buyer asks to see next.
Example
A good answer to “how do you vet vendors?”
“Before a new vendor gets customer data, its owner checks its security documentation and data processing terms, and we require multi-factor authentication on our accounts. Vendors with customer data are reviewed yearly. Our current subprocessors are hosting, email delivery and our support desk.”
Or let 93 Compliance keep the list
The vendors and systems registers keep each vendor with its owner, review-due date and multi-factor status. An AI suggests vendors and systems from what you’ve already told it, and only when it can quote where it found them.
If the vendor management policy doesn’t exist yet, the policy builder’s AI assistant drafts it as tracked changes for an owner to accept. Paste the buyer’s questionnaire and the vendor questions are tested against your policies, green, yellow or red.
The registers, the policy builder and the questionnaire check are free, with no card.
- Vendors register with owners and review dates
- Vendor suggestions, each with a quote from its source
- A vendor management policy drafted for you
- Vendor questions in the questionnaire tested against your policies
Start my vendor list
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
What is a subprocessor?
A vendor that stores or processes your customers’ data on your behalf, such as hosting, email delivery or a support desk. Buyers often ask for the list, and some contracts require you to tell them before you add one.
Do we need every vendor’s SOC 2 report?
No. Ask for it from vendors that hold customer data, and keep what they send. For low-risk tools a quick look at their security page is enough.
How often should we review vendors?
Yearly for vendors with customer data, and whenever one changes ownership, has a breach or changes how it handles data. Tools with no customer data can be checked less often.