SOC 2 CC9.2: Risk Mitigation - Vendor and Business Partner Risk Management

Build a vendor risk management programme with a defined methodology. Create a vendor inventory cataloguing every third party with access to your systems, data, or facilities. Classify vendors by risk tier based on the sensitivity of data they touch, how critical their services are, and their level of access to your environment. Run due diligence before engaging any new vendor. Review security certifications (SOC 2, ISO 27001), send a security questionnaire, evaluate their practices against your requirements, and for high-risk vendors, consider on-site assessments or detailed technical reviews. Put security requirements into contracts. Key provisions: security standards the vendor must maintain, data protection and privacy obligations, breach notification requirements with specific timelines, right-to-audit clauses, insurance requirements, data handling and return/destruction at contract end, and regulatory compliance obligations. Monitor vendor risk on an ongoing basis. Reassess high-risk vendors annually, medium-risk vendors every two years. Watch for material changes - security incidents, ownership changes, financial instability. Subscribe to threat intelligence that might flag vendor compromises. Manage vendor access with the same rigour as employee access. Apply least privilege, use dedicated vendor accounts (never share employee credentials), set time limits for project-based access, monitor vendor activity in your systems, and review access logs regularly. Have a vendor offboarding process. When a relationship ends, revoke all access, get your data returned or destroyed, and confirm that surviving obligations (like confidentiality clauses) are understood by both parties.