Vendor Management
What is Vendor Management?
The discipline of managing external vendors and suppliers to maximize value, minimize risk, and ensure service quality and compliance.
Terms that appear alongside vendor management
Each of these is named in at least one of the same controls as vendor management. The number is how many controls name both.
- audit 12 shared controls
- compliance 9 shared controls
- due diligence 8 shared controls
- consent 7 shared controls
- data subject 5 shared controls
- resilience 5 shared controls
- breach notification 5 shared controls
- breach response 5 shared controls
Frameworks that govern vendor management
What the standards actually require on vendor management
Requirements naming vendor management across 6 standards, quoted from the control text.
Manage vendor and supply-chain security for ICS components, including integrator and maintenance-provider security, third-party access, and provenance of hardware/software/patches.
CISA-ICS-DID-28 · Vendor Management and Supply Chain Security →Sections 24-26 of the Jamaica DPA 2020 establish the framework for Joint Controllers + Processors + Sub-Processors + and Records of Processing Activities.
JM-DPA2020-Joint-Controller-Processor-Sec24-25-26-Arrangements-Allocation-Responsibilities-Contracts · Jamaica DPA 2020 Joint Controllers + Processors + Sections 24-26 + Arrangements + Allocation of Responsibilities + Contracts + Records of Processing Activities (ROPA) + Sub-Processors + Vendor Management →Kuwait KDPPR Articles 4 + 7 data processor + third-party vendor obligations. Controllers must conduct due diligence on Processors + cloud providers + ensure: (1) Documented contracts specifying purposes + scope + categories of Personal Data + duration + obliga...
KDPPR-Data-Processor-Vendor-Management-Contractual-Obligations-Subprocessor-Article-4-7-Cloud · Kuwait KDPPR Data Processor + Vendor Management + Contractual Obligations + Subprocessor →Dominican Republic Law 172-13 Articles 23-24 + 26 + 80 Cross-Border + Third Parties + Marketing. Article 80 Cross-Border Data Transfers (Transferencias Internacionales) - transfer of personal data outside Dominican Republic permitted where: (1) destination jur...
DOM172-Cross-Border-Transfer-Article-80-Vendor-Processor-Management-Marketing-Direct-Communications-Article-23-24-26 · Dominican Republic Law 172-13 Cross-Border Transfer + Vendor Management + Marketing + Articles 23-24-26-80 →Operate third-party risk + supply chain + resilience + metrics + continuous improvement per NRF framework. Third-party risk must (a) maintain vendor inventory categorised by data access + critical service + payment processing + e-commerce platform + cloud serv...
NRFCS-8 · Third-Party Risk, Supply Chain, Vendor Management, Resilience, Peak-Season Readiness, Metrics, Continuous Improvement →Protect patron data + employee data + financial transaction data + responsible gaming data per NGC 5.260(i). Maintain data inventory + classification scheme (confidential + restricted + internal + public) + data flow mapping.
NGCB-7 · Patron and Employee Data Protection + Data Inventory + Vendor Management →Questions people ask about vendor management
What is Vendor Management?
Why is Vendor Management important for compliance?
Which compliance frameworks address Vendor Management?
Where can I learn more about Vendor Management?
See how Vendor Management applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.