Vendor Inventory

What is a vendor inventory?

A vendor inventory is one list of every company you buy products or services from, with the facts you need to manage each one. It is the first step of vendor risk management: you cannot assess or watch a vendor you do not know you have.

Frameworks treat it as a basic control. NIST's Cybersecurity Framework 2.0 says "Suppliers are known and prioritized by criticality" (GV.SC-04), and NIST's quick-start guide says to "Keep a record of all suppliers". The 2023 US bank guidance lists "Maintaining a complete inventory of its third-party relationships" as part of risk management.

Is a vendor inventory required for SOC 2?

The SOC 2 criteria do not use the word "inventory". Criterion CC9.2 says "The entity assesses and manages risks associated with vendors and business partners." In practice, you cannot show you assessed every vendor without a list, so a vendor inventory is the usual way to meet it. A list you can check against card statements and connected apps is also easier to defend.

A simple template

A spreadsheet works. Use one row per vendor and these columns:

• Vendor and product: the company and the specific product you use.
• Purpose: what you use it for, in a few words.
• Business owner: the person who uses it and answers questions about it.
• Data: what data goes in (customer personal data, employee data, source code, none).
• Tier: high, medium or low, based on data and how much you depend on it. See vendor tiering.
• Documents: links to its Terms of Service, DPA, subprocessor list and trust center.
• Security report: SOC 2 or ISO 27001, with the audit period end date.
• Contract: plan, annual cost, renewal date and notice period.
• Last review and next review: dates, with who did it.

What it looks like in a vendor's terms

Your inventory should point to the version of each document that applies to you. Many vendor agreements pull in other pages by link. A typical clause reads like this:

This Agreement includes the Data Processing Addendum, the Acceptable Use Policy and the Service-Specific Terms, each available on our website and each as updated from time to time.

• "Includes" means those pages are part of your contract, even though you never signed them separately. This is incorporation by reference.
• "Available on our website" means the binding text lives on a web page, not in your files.
• "As updated from time to time" means the linked page can change, and the change can become part of your contract.

So an inventory with only a vendor name is not enough. Save the links, and save a copy of what each page said when you reviewed it.

A real change we caught

Inventories go stale from the inside too. Venpo found that at least 30 vendors added Anthropic as a subprocessor since September. Each vendor in your list stayed the same, but the data column ("where does our data go?") changed for every one of them that you use.

Why it matters to you

Your inventory feeds your own promises. When a customer asks which vendors handle their data, or sends a security questionnaire, the answer comes from this list. When you publish your own subprocessor list, it is a filtered view of this list.

It also saves money. The contract columns show renewal dates and notice periods, so you can cancel or renegotiate before an auto-renewal locks in another year.

And it is the first thing an auditor or acquirer will ask for.

What to check

• Compare the list with card statements, invoices and expense reports every quarter.
• Compare it with the apps connected to your login provider and your workspace tools. Tools found this way are often shadow IT.
• Make sure every row has an owner and a tier.
• For high-tier vendors, keep the subprocessor list link. A good list, like Atlassian's, shows purpose, data types and locations.
• Mark vendors you stopped using and record when offboarding was finished.

How Venpo helps

Once you add your vendors to Venpo, it watches the legal pages behind each row: Terms of Service, privacy policy, DPA, subprocessor list and other public pages. When one changes, you get a plain-English email alert, and each vendor keeps a change history you can point to from your inventory.