Vendor Management
What is Vendor Management?
The discipline of managing external vendors and suppliers to maximize value, minimize risk, and ensure service quality and compliance.
Terms that appear alongside vendor management
Each of these is named in at least one of the same controls as vendor management. The number is how many controls name both.
- audit 12 shared controls
- compliance 9 shared controls
- due diligence 8 shared controls
- consent 7 shared controls
- data subject 5 shared controls
- resilience 5 shared controls
- breach notification 5 shared controls
- breach response 5 shared controls
Frameworks that govern vendor management
What the standards actually require on vendor management
Requirements naming vendor management across 6 standards, quoted from the control text.
Manage vendor and supply-chain security for ICS components, including integrator and maintenance-provider security, third-party access, and provenance of hardware/software/patches.
CISA-ICS-DID-28 · Vendor Management and Supply Chain Security →Sections 24-26 of the Jamaica DPA 2020 establish the framework for Joint Controllers + Processors + Sub-Processors + and Records of Processing Activities.
JM-DPA2020-Joint-Controller-Processor-Sec24-25-26-Arrangements-Allocation-Responsibilities-Contracts · Jamaica DPA 2020 Joint Controllers + Processors + Sections 24-26 + Arrangements + Allocation of Responsibilities + Contracts + Records of Processing Activities (ROPA) + Sub-Processors + Vendor Management →Operate third-party risk + supply chain + resilience + metrics + continuous improvement per NRF framework. Third-party risk must (a) maintain vendor inventory categorised by data access + critical service + payment processing + e-commerce platform + cloud serv...
NRFCS-8 · Third-Party Risk, Supply Chain, Vendor Management, Resilience, Peak-Season Readiness, Metrics, Continuous Improvement →Per Privacy Act + OAIC + Privacy Reform Bill 2024-2025: governance + lifecycle + enforcement. Requirements include (a) cooperate with OAIC including responding to inquiries + facilitating audits + complying with determinations + (b) maintain Vendor and Outsour...
AUPRV-8 · OAIC Cooperation, Vendor Management, Training, Complaints, Enforcement →The institution has adequate due diligence processes, appropriate contract provisions and provider monitoring procedures for the third parties and other institutions that supply wholesale payment products and services, monitors selected wholesale transactions...
ffiec-it-examination-handbook::WPS-15 · Vendor and Third-Party Management (Wholesale Payment Systems) →Section 5 establishes sponsor responsibilities and quality management. Sponsor must implement a Quality Management System (QMS) per R3 covering: risk identification + assessment + mitigation + acceptance + monitoring + review;
ICH-E6-Sponsor-QualityRiskMgmt-Monitoring-CRO-Vendor · ICH E6 Section 5 - Sponsor + Quality Management System + Risk-Based Monitoring + CRO + Vendor Oversight →Questions people ask about vendor management
What is Vendor Management?
Why is Vendor Management important for compliance?
Which compliance frameworks address Vendor Management?
Where can I learn more about Vendor Management?
See how Vendor Management applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.