Start for free Start for free

Vendor Onboarding

Vendor onboarding is the set of steps you take when you start using a new vendor: checking its risk, accepting its terms, setting it up safely and adding it to your vendor list with an owner.

What is vendor onboarding?

Vendor onboarding is the set of steps you take when you start using a new vendor: checking it, signing up, setting it up and adding it to your records. Done well, it means every new tool arrives reviewed, owned and on your list, instead of being found months later.

NIST's Cybersecurity Framework asks for "Planning and due diligence" before you enter a supplier relationship (GV.SC-06). For a 20 to 100 person company, onboarding can be a short checklist that takes an hour for a low-risk tool and a few days for one that holds customer data.

A simple onboarding flow:

  1. Request. The person who wants the tool says what it is for and what data it will get.
  2. Tier. Decide how risky it is, based on the data and how much you will depend on it. See vendor tiering.
  3. Review. For higher tiers, run a vendor risk assessment: SOC 2 report, DPA, subprocessor list and Terms of Service.
  4. Sign. Accept or sign the DPA and save the version of each document you agreed to.
  5. Subscribe. Sign up for subprocessor and terms change notices with a shared inbox.
  6. Set up. Turn on single sign-on, limit admin access and turn off features you do not want, such as AI training on your data.
  7. Record. Add it to your vendor inventory with owner, tier, renewal date and next review date.

Why it matters to you

Onboarding is the cheapest moment to say no or to ask for changes. Before you sign, a vendor may answer questions it will not answer once you are a customer.

It is also the only time many terms get read. If nobody saves the version you accepted, you cannot tell later what changed. And some protections only work if you act at the start. Stripe's DPA, for example, sends subprocessor change notices by email only to users who subscribe.

A SOC 2 auditor will look for proof that new vendors were reviewed. The CC9.2 points of focus include setting requirements for vendor engagements, and your onboarding record is that proof.

What to check

  • Whether the vendor trains AI on your data, and how to switch that off.
  • How long it keeps your data after you leave, and how you get it back.
  • How much notice it gives before changing terms or adding subprocessors.
  • The renewal date and notice period, so you can add them to your renewal calendar.
  • That the person who accepted the terms had authority to do so.

How Venpo helps

Add a new vendor to Venpo during onboarding and the Fine Print Scan answers four questions right away: does it train AI on your data, how long does it keep data, does it sell data or use it for ads, and can it raise prices. From then on, Venpo emails you a plain-English alert when its legal pages change.

Start for free

Frequently asked questions

How long should vendor onboarding take?

For a tool with no sensitive data, often under an hour. For a vendor that will hold customer data, allow time to read its SOC 2 report and DPA and to get answers to open questions.

Who should approve a new vendor?

Usually the person who owns security or compliance, with the budget owner for cost. For low-risk tools, a team lead can approve as long as the tool gets added to the vendor list.

Related terms

Vendor Management Vendor Risk Assessment A vendor risk assessment is a check of how much risk a vendor brings, based on the data it gets, how much you depend on it and what its documents promise. You do it before you sign and again when something important changes. Vendor Management Vendor Offboarding Vendor offboarding is what you do when you stop using a vendor: export your data, have the vendor delete what it holds, remove its access to your systems and update your records. Vendor Management Vendor Inventory A vendor inventory is one list of every company you buy from, with an owner, the data it handles, its risk tier, links to its legal documents and its renewal date. It is the starting point for managing vendor risk and for a SOC 2 audit. Vendor Management Vendor Tiering Vendor tiering is sorting your vendors into groups by how much risk they bring, based on the data they hold and how much you depend on them, so you review the riskiest ones more deeply and more often. Vendor Management Vendor Management Policy A vendor management policy is your company's own written rules for choosing, checking, watching and leaving vendors. It tells your team what to do and shows auditors and customers what you committed to.

Sources

Last reviewed