Vendor Management

AI Vendor Risk Assessment An AI vendor risk assessment adds questions for vendors that use AI on your data: whether they train on it, how long they keep prompts and outputs, which AI providers they use and who owns the output. Annual Vendor Review An annual vendor review is a yearly check of your important vendors to confirm they are still needed, still correctly rated for risk and still meet your requirements, using their latest security reports and legal documents. Concentration Risk Concentration risk is the danger that many of your vendors rely on the same cloud provider, AI model or other supplier underneath. If that one supplier fails, changes its terms or has a breach, several of your tools are hit at once. Continuous Vendor Monitoring Continuous vendor monitoring means watching your vendors between formal reviews, so you learn about changed terms, new subprocessors, security problems or business trouble when they happen instead of at the next annual review. Critical Vendor A critical vendor is one you cannot operate without, or whose failure would seriously hurt your customers, such as your cloud host, payment processor or main customer database. End of Life Notice An end of life notice is a vendor's announcement that it will stop selling, supporting or running a product, plan or feature on a set date. It starts the clock on your move to a replacement and on getting your data out. Feature Deprecation Feature deprecation is when a vendor removes or retires one feature while the product keeps running, often with less notice than a full product shutdown. Fourth-Party Risk Fourth-party risk is the risk from your vendors' own vendors, such as the cloud host or AI provider a tool uses to process your data. For software, these are mostly the subprocessors on a vendor's subprocessor list. Inherent vs Residual Risk Inherent risk is how risky a vendor is before any safeguards. Residual risk is what remains after your controls and the vendor's controls are counted. Nth-Party Risk Nth-party risk is the risk from providers further down your vendor chain, such as your vendor's AI provider's cloud host. You manage it mainly by checking how your vendors oversee their own providers. SaaS Management SaaS management is the practice, and the category of tools, for tracking which software subscriptions a company has, who uses them and what they cost. It covers licenses, spend and renewals, which is a different job from reading what each vendor's legal terms say. SaaS Renewal Calendar A SaaS renewal calendar is one shared list of every software subscription with its renewal date, the last day to cancel and the expected price. It gives you time to cancel, renegotiate or approve each renewal before it happens automatically. SaaS Sprawl SaaS sprawl is when a company ends up with more software subscriptions than it can track. Each tool brings its own terms, privacy policy, renewal date and access to your data, so cost and risk pile up unseen. Security Rating A security rating is a score an outside company gives a vendor based on what it can see from the internet. It can warn you early, but it cannot see contracts, data use or internal controls. Shadow IT Shadow IT is software or online services people use for work without the company knowing or approving it. Each one is a vendor nobody reviewed, with terms someone accepted for the company and nobody read. Third-Party Risk Management (TPRM) Third-party risk management is how you manage the risks from any outside company you work with, including vendors, contractors and partners. It covers checking them before you start, watching them while you work together and closing things out when you stop. Vendor Due Diligence Vendor due diligence is the homework you do before signing with a vendor: collecting its security reports, DPA, subprocessor list and terms, and recording who reviewed them and what was decided. Vendor Inventory A vendor inventory is one list of every company you buy from, with an owner, the data it handles, its risk tier, links to its legal documents and its renewal date. It is the starting point for managing vendor risk and for a SOC 2 audit. Vendor Lock-In Vendor lock-in is when leaving a vendor would cost so much time, money or data that you stay even when you would rather go. It usually comes from data you cannot easily export, long commitments and workflows built around one tool. Vendor Management Policy A vendor management policy is your company's own written rules for choosing, checking, watching and leaving vendors. It tells your team what to do and shows auditors and customers what you committed to. Vendor Offboarding Vendor offboarding is what you do when you stop using a vendor: export your data, have the vendor delete what it holds, remove its access to your systems and update your records. Vendor Onboarding Vendor onboarding is the set of steps you take when you start using a new vendor: checking its risk, accepting its terms, setting it up safely and adding it to your vendor list with an owner. Vendor Risk Assessment A vendor risk assessment is a check of how much risk a vendor brings, based on the data it gets, how much you depend on it and what its documents promise. You do it before you sign and again when something important changes. Vendor Risk Management (VRM) Vendor risk management is how you find, judge and keep watching the risks that come from the companies you buy from, such as data leaks, outages, price increases and changed terms. It runs from picking a vendor to leaving it. Vendor Tiering Vendor tiering is sorting your vendors into groups by how much risk they bring, based on the data they hold and how much you depend on them, so you review the riskiest ones more deeply and more often.