Third-party risk management

Vendors extend your attack surface. This objective covers vendor assessment, selection, agreements, monitoring, questionnaires, and rules of engagement.

Assessment and selection

Vendor assessment can include penetration testing (with permission), right-to-audit clauses, evidence of internal audits, independent assessments such as SOC 2 reports, and supply chain analysis. Selection involves due diligence (investigating the vendor's security and finances) and checking for conflicts of interest.

Agreements and monitoring

Vendor monitoring continues after signing: periodic questionnaires, reviews of new audit reports, and tracking incidents. Rules of engagement define what testers or vendors may and may not do.

Key terms

Service-level agreement (SLA)

A contract that defines measurable service commitments such as uptime and response times.

Memorandum of understanding (MOU)

A document describing shared intent and roles between parties, usually not strongly binding.

Master service agreement (MSA)

A contract setting general terms that apply to future work orders between two parties.

Statement of work (SOW)

A document defining specific deliverables, timelines, and costs for a project.

Non-disclosure agreement (NDA)

A contract that requires parties to keep shared information confidential.

Business partners agreement (BPA)

An agreement that sets terms, responsibilities, and profit sharing between business partners.

Right-to-audit clause

A contract term that lets a customer audit a vendor's security controls.

Due diligence

Investigating a vendor's security, finances, and reputation before entering an agreement.

Vendor questionnaire

A standard set of security questions a vendor answers to describe its controls.

Rules of engagement

Documented limits on what testers or vendors may do during an assessment.

Vendor monitoring

Ongoing review of a third party's security and performance after the contract starts.