Vendor risk management
Also known as Third-party risk
Assessing and monitoring the security of suppliers who handle your data or connect to your systems.
Outsourcing a function does not outsource the risk or, usually, the regulatory responsibility. Several of the largest breaches on record reached their victim through a supplier.
Proportionate assessment is the goal. A vendor holding client records warrants a real review and contractual commitments; the company that services the coffee machine does not.
Where this comes up
Vendor risk management sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.