Many risks facing an organisation come from third-party organisations with whom the organisation does business. These risks may be the result of a vendor relationship that arises somewhere along the organisation's supply chain, or they may be the result of other business partnerships. ### Vendor Selection *Due diligence* involves thoroughly vetting potential vendors to ensure that they meet the organisation's standards and requirements. This process should include an evaluation of the vendor's financial stability, business reputation, quality of products or services, and compliance with relevant regulations. You should also examine the vendor's security practices and data handling procedures, especially when they will be dealing with sensitive or proprietary information. Another essential aspect of vendor selection is identifying and *mitigating conflicts of interest*. A conflict of interest arises when a vendor has a competing interest that could influence their behaviour in a way that is not aligned with the best interests of the organization. ### Vendor Assessment After the initial selection process, organisations should continuously assess the chosen vendors to ensure they *maintain the expected quality, security, and performance levels*. One method to evaluate a vendor's security is **through penetration testing**, where authorised simulated attacks are carried out to identify vulnerabilities in the vendor's systems. Vendor agreements *should include a right-to-audit* clause that allows the customer to conduct or commission audits on the vendor's operations and practices to ensure compliance with terms and conditions, as well as regulatory requirements. Furthermore, organisations should **request evidence of internal audits** conducted by the vendor. These audits can provide insights into the vendor's internal controls, compliance, and risk management practices. *Independent assessments* are also an essential tool. They may involve bringing in third-party experts to objectively evaluate the vendor's practices and systems. These assessments can include certification verifications, such as **ISO 27001 or SOC reports**. *Supply chain analysis* is vital in understanding the risks associated with the vendor's supply chain. This includes assessing the vendor's suppliers and understanding the interdependencies and risks that could impact the vendor's ability to deliver products or services. Organisations can *employ questionnaires* to collect information regarding the vendor's practices and performance regularly. These questionnaires can be tailored to focus on specific areas of concern, such as security policies, data handling procedures, and business continuity planning. ### Vendor Agreements Organisations may deploy some standard agreements and practices to manage third-party vendor risks. Commonly used agreements include the following: - **Master service agreements** (MSAs) provide an umbrella contract for the work that a vendor does with an organisation over an extended period of time. The MSA typically includes detailed security and privacy requirements. Each time the organisation enters into a new project with the vendor, they may then create a work order (WO) or a statement of work (SOW) that contains project-specific details and references the MSA. - **Service level agreements** (SLAs) are written contracts that specify the conditions of service that will be provided by the vendor and the remedies available to the customer if the vendor fails to meet the SLA. SLAs commonly cover issues such as system availability, data durability, and response time. - **A memorandum of understanding** (MOU) is a letter written to document aspects of the relationship. MOUs are an informal mechanism that allows the parties to document their relationship to avoid future misunderstandings. MOUs are commonly used in cases where an internal service provider is offering a service to a customer that is in a different business unit of the same company. - **A memorandum of agreement** (MOA) is a formal document that outlines the terms and details of an agreement between parties, establishing a mutual understanding of the roles and responsibilities in fulfilling specific objectives. MOAs are generally more detailed than MOUs and may include clauses regarding resource allocation, risk management, and performance metrics. - **Business partners agreements** (BPAs) exist when two organisations agree to do business with each other in a partnership. For example, if two companies jointly develop and market a product, the BPA might specify each partner's responsibilities and the division of profits. ### Vendor Monitoring Effective vendor monitoring is crucial for managing and mitigating third-party risks. It involves the *continuous observation and analysis of a vendor's performance and compliance to ensure that they adhere to the contractual obligations and meet the organisation's expectations*. One of the critical aspects of vendor monitoring is **establishing rules of engagement**. These rules define the boundaries within which the vendor should operate. They normally include *setting clear communication protocols, defining responsibilities, and establishing processes for issue resolution*. By setting these rules, organisations can ensure that both parties are on the same page regarding expectations and obligations, which can help in preventing misunderstandings and disputes. Performance monitoring is a central component of vendor monitoring. Organisations should establish **key performance indicators** (KPIs) that quantitatively measure the vendor's performance. Regularly monitoring these metrics allows organisations to ensure that vendors are meeting the agreed-upon standards. In addition, security monitoring should be performed to ensure that the vendor maintains adequate security practices. This involves monitoring the vendor's security posture, checking for any data breaches or security incidents, and ensuring that they are in compliance with relevant security standards and regulations. **Compliance monitoring** is also essential, particularly for vendors handling sensitive data or operating in highly regulated industries. Organisations should ensure that vendors are in compliance with legal and regulatory requirements and that they have the necessary certifications and accreditations. Financial monitoring involves evaluating the vendor's financial health to ensure they remain a viable partner. This is particularly important for long-term contracts where the organisation might be dependent on the vendor's services for an extended period. ### Winding Down Vendor Relationships All things come to an end, and third-party relationships are no exception. Organisations should take steps to ensure that they have an orderly transition when a vendor relationship ends or the vendor is discontinuing a product or service on which the organisation depends. This should include specific steps that both parties will follow to have an orderly transition when the vendor announces a product's end of life (EOL) or a service's end of service life (EOSL). These same steps may be followed if the organisation chooses to stop using the product or service on its own.