Free Vendor Risk Management Policy Template

This policy sets how [Company Name] (the "company") selects, contracts with, monitors, and ends relationships with vendors that can affect the security of its information and systems or the continuity of its operations. The company remains responsible for its information even when a vendor holds it.

Framework. The policy follows the supply chain risk management activities of the NIST Cybersecurity Framework (CSF) 2.0 (category GV.SC) at a scale suited to a small or mid-sized company, and the FTC's guidance that vendor security expectations be put in writing and verified.

Relationship to laws and contracts. Laws, customer contracts, and insurance policies may set stricter vendor requirements than this policy. Where they do, the stricter requirement applies. Have qualified legal counsel review contract language before relying on it.

This policy applies to every vendor, supplier, contractor, consultant, and cloud service that stores, processes, or can access [Company Name] information, that can connect to company systems, or whose failure would disrupt company operations. It applies to every employee who selects, buys from, or manages such a vendor. One-time purchases of goods with no access to information or systems are outside its scope.

Vendor

Any outside company or person that provides goods or services to the company, including software and cloud services, IT and security providers, payroll and accounting firms, and equipment suppliers that provide remote support.

Vendor owner

The employee responsible for a vendor relationship: requesting it, keeping its records current, and ending it properly.

Critical vendor

A vendor that holds sensitive or regulated company information, can connect to company systems, or whose outage would stop critical operations.

SOC 2 Type II report

An independent auditor's report on how well a service provider's security controls worked over a period of time, usually six to twelve months.

Subcontractor (fourth party)

A company your vendor uses to deliver its service to you, such as the cloud host behind a software product.

The Operations Manager keeps a vendor inventory and reviews it at least every six months against accounts payable and IT records, so that no vendor with access is missed. For each vendor in scope it records:

• Vendor name, the service provided, the vendor owner, and the vendor's security and support contacts.
• The types of company information it holds or can access, and where that information is stored.
• Any accounts, remote access tools, or network connections it has into company systems.
• Its risk tier, the date of its last review, and the date of its next review.
• Contract start, renewal, and end dates, and where the signed contract is kept.

The Operations Manager assigns each vendor a tier when it is added and whenever the service changes. When in doubt, the higher tier applies.

Before a contract is signed or access is granted, critical vendors provide evidence of their security. The company accepts:

• A current SOC 2 Type II report, with its bridge letter if the report period ended more than three months ago.
• An ISO/IEC 27001 certificate whose scope covers the services provided to the company.
• A completed company security questionnaire, signed by a responsible officer of the vendor.
• A certificate of insurance showing cyber liability coverage suited to the service.

Key questions. Whatever the evidence, the review confirms the answers to these questions:

• Does the vendor require multi-factor authentication for its own staff and for access to company information?
• Is company information encrypted when stored and when sent?
• How does the vendor back up company information, and how quickly can it restore service after an outage or ransomware attack?
• Has the vendor had a security breach in the last three years, and what changed afterwards?
• Where will company information be stored, and which subcontractors will handle it?
• How will company information be returned or destroyed when the contract ends?

Decision. The Operations Manager records the result. A vendor with significant gaps may be approved only with added safeguards or contract terms, or with the Chief Executive Officer's written acceptance of the risk.

Contracts with critical vendors, and with any vendor that holds Confidential information, must include terms covering:

• Confidentiality of company information, and use of it only to provide the contracted service.
• Reasonable administrative, technical, and physical security controls, including multi-factor authentication and encryption, maintained for the life of the contract.
• Notice to the company of any security incident affecting company information or systems within 72 hours of discovery, followed by cooperation with the company's investigation and response.
• The company's right to request current security evidence, such as an updated SOC 2 report or questionnaire, at least once a year.
• Compliance with the laws that apply to the information the vendor handles.
• Return or certified destruction of company information within 30 days after the contract ends, with written confirmation.
• Disclosure of subcontractors that will handle company information, with the same security obligations passed down to them, and notice before a new one is added.

Where a vendor will not accept a required term, the Operations Manager documents the gap and any compensating safeguard, and the Chief Executive Officer decides whether to proceed. Legal counsel reviews contract language for critical vendors.

• Each vendor person gets an individual account; shared vendor logins are not allowed.
• Every vendor account that reaches company systems or information uses multi-factor authentication.
• Vendor access is limited to the systems and information the work requires.
• Remote access is enabled by company staff only for an approved session and disabled when the work ends. Unattended or always-on remote access tools are not allowed.
• Only company-approved remote access tools are used. Vendors may not install their own remote access software on company systems.
• Vendor accounts and remote sessions are logged, and vendor accounts are reviewed at least every three months.

Critical vendors are reviewed every year, and moderate-risk vendors every two years. A review confirms the vendor's current security evidence, any incidents since the last review, whether its access is still needed, and whether its risk tier is still right.

Triggers for an early review. A vendor is reviewed sooner if it reports a security incident, is in the news for one, is acquired, changes the service or where data is stored, or if the company starts sending it more sensitive information.

Any notice of a vendor security incident, or any sign that a vendor account is being misused, is reported immediately to the Operations Manager and handled under the company incident response plan. The company may suspend the vendor's access while the incident is investigated, asks the vendor for the facts it needs to meet its own legal and contract obligations, and, through legal counsel, decides whether any notice is owed to customers, employees, or regulators.

Customer requirements. Where a customer contract sets requirements for the company's own vendors, such as approved subcontractors or data location limits, the vendor owner records them in the inventory and they are applied to every vendor that handles that customer's information.

[Company Name] expects its suppliers to operate lawfully and responsibly. Significant suppliers are asked to confirm in writing, through a supplier code of conduct or contract terms, that they:

• Comply with applicable environmental laws and work to reduce waste, emissions, and hazardous materials.
• Provide safe working conditions, pay at least legally required wages, and do not use child labor, forced labor, or human trafficking.
• Do not engage in bribery, corruption, or anticompetitive practices, and protect the confidentiality of information entrusted to them.
• Apply similar expectations to their own suppliers.

The Operations Manager keeps the signed commitments and records any concerns raised during supplier reviews and the action taken. Customer requirements, such as EcoVadis assessments or supplier codes of conduct, are applied where they are stricter.

When a vendor relationship ends, or a vendor no longer needs access, the vendor owner starts offboarding and the IT staff or provider completes it:

1. Disable every vendor account and remove any remote access tool or network connection the same day.
2. Change any shared passwords, keys, or codes the vendor knew.
3. Recover company equipment, badges, and keys.
4. Obtain written confirmation, within 30 days, that company information was returned or securely destroyed.
5. Update the vendor inventory and keep the offboarding record with the contract.

Exceptions. An exception to this policy must be requested in writing from the Operations Manager, with the reason, the risk, and any compensating safeguard. Exceptions for critical vendors require the Chief Executive Officer's approval and are reviewed at least once a year.

Enforcement. Signing up for a service that holds company information, or giving a vendor access, outside this process may result in disciplinary action consistent with applicable law, and the service may be shut off.

Policy review. The Operations Manager reviews this policy no later than October 2, 2027, and after any significant vendor incident. Changes are approved by the Chief Executive Officer.

Approval. Sign below to approve this document for adoption by [Company Name] after it has been reviewed by your legal counsel. Until it is signed, it is a draft and is not in effect.

Revision history. Record every change to this policy below. Increase the document version and obtain approval again each time the policy is revised.

This document was generated from a starter template provided by Preferred Data Corporation. It is general information only. It is not legal advice and it is not a substitute for advice from a licensed attorney. Using the template does not create an attorney-client, consulting, or other professional relationship.

Preferred Data Corporation is not a law firm or an insurer. It makes no representation that this document is complete, current, or suitable for any particular organization, industry, jurisdiction, or regulatory requirement. To the fullest extent permitted by law, it is not responsible or liable for any loss or damage arising from the use of this template or of any policy created from it. You are solely responsible for how you adapt, adopt, and enforce it.

Laws, regulations, insurance requirements, and contracts that apply to your organization may require different or additional terms. The facts, deadlines, and legal references in this template were checked against their sources on the date shown as "Template content last reviewed" in Document Control, not on the effective date, and may have changed since. Before you adopt, publish, or rely on this document, and in every case where you have a legal, regulatory, or contractual obligation, have it reviewed by qualified legal counsel.

In an actual security incident or data breach, contact your attorney, your cyber insurer, and law enforcement where appropriate. Do not rely on this template alone to decide whether, when, or how to notify anyone.

If Preferred Data Corporation prepared this document for you as part of its services, your service agreement governs those services. The content of this document is still general information and should be reviewed by your own counsel before you adopt it.

This template is provided "as is", without warranties of any kind, including accuracy, completeness, or fitness for a particular purpose. Links to laws, agencies, and other websites are provided for convenience and may change. Use of this template is also subject to the Website and Free Resources Disclaimer and the Terms of Service at preferreddata.com/legal/disclaimer and preferreddata.com/legal/terms-of-service.

To report an error, contact Preferred Data Corporation at preferreddata.com/contact or (336) 886-3282 and include the Document ID shown in Document Control. Corrections are listed in the template changelog on the template's page at preferreddata.com/policy-templates.