Vendor Risk Management Program SOP¶

Sub-procedure for Operate pillar managed services - VRM program establishment and management

Service Pillar: Operate Service Category: Vendor Risk Management Parent SOP: Cloud Operations SOP Engagement Type: Program Development / Ongoing Management

Overview¶

Establishment and management of a comprehensive Vendor Risk Management (VRM) program to identify, assess, and mitigate risks associated with third-party vendors and service providers. This procedure covers program governance, risk tiering, policy development, and ongoing vendor portfolio management.

Scope¶

Pillar: Operate (Managed Services) Service Area: Vendor Risk Management Program

In Scope¶

VRM program governance structure
Vendor risk tiering methodology
VRM policy and procedures
Vendor inventory management
Vendor lifecycle management
Executive reporting and metrics
Compliance framework alignment

Out of Scope¶

Individual vendor assessments (see Vendor Assessment SOP)
Continuous monitoring implementation (see Vendor Monitoring SOP)
Contract negotiation
Vendor selection/procurement

Business Justification¶

Metric	Value	Source
Breaches involving third parties	62%	Verizon DBIR 2024
Average cost of third-party breach	$4.55M	IBM Cost of Data Breach 2024
Organizations without VRM program	45%	Gartner Third-Party Risk Survey 2024
Regulatory fines for vendor failures	Increasing 30% YoY	BitSight Third-Party Risk Report

Prerequisites¶

Executive sponsorship (CFO, CIO, or CISO)
Budget allocation for VRM activities
Cross-functional stakeholder commitment
Access to current vendor contracts
Understanding of regulatory requirements
Risk appetite statement from leadership

Procedure¶

Step 1: Program Governance Establishment¶

Objective: Create governance structure for VRM accountability

Activities: 1. Define VRM program charter 2. Establish VRM steering committee 3. Assign roles and responsibilities 4. Define decision-making authority 5. Create escalation procedures 6. Establish meeting cadence

Governance Structure: | Role | Responsibilities | Authority | |------|-----------------|-----------| | VRM Sponsor (Exec) | Program oversight, budget | Final risk decisions | | VRM Lead | Day-to-day program management | Assessment approvals | | Risk Committee | Periodic review, policy approval | Risk acceptance | | Business Owners | Vendor relationship management | Vendor selection input | | Legal/Procurement | Contract management | Contract terms | | IT Security | Security assessments | Technical requirements |

Steering Committee Cadence: - Monthly: Operational review - Quarterly: Strategic review, metrics - Annual: Program assessment, planning

Duration: 2-4 weeks

Step 2: Vendor Risk Tiering Framework¶

Objective: Establish risk-based categorization for vendors

Tiering Criteria: | Factor | Weight | Assessment Method | |--------|--------|------------------| | Data access | 30% | Data classification | | System access | 25% | Integration level | | Criticality | 25% | Business impact | | Regulatory scope | 20% | Compliance requirements |

Tier Definitions:

Tier 1 - Critical: - Access to sensitive/regulated data - Direct system integration - Critical to operations - Regulatory implications

Tier 2 - High: - Access to confidential data - Some system access - Important but not critical - Some regulatory scope

Tier 3 - Moderate: - Limited data access - No direct system integration - Supportive function - Minimal regulatory scope

Tier 4 - Low: - No data access - No system access - Non-critical function - No regulatory implications

Assessment Requirements by Tier: | Tier | Assessment | Frequency | Due Diligence | |------|-----------|-----------|---------------| | 1 | Full security assessment | Annual | Extensive | | 2 | Security questionnaire | Annual | Moderate | | 3 | Self-attestation | Biennial | Limited | | 4 | Acknowledgment only | Onboarding | Minimal |

Duration: 2-3 weeks

Step 3: VRM Policy Development¶

Objective: Document policies governing vendor risk management

Core Policies:

Vendor Risk Management Policy: - [ ] Purpose and scope - [ ] Governance structure - [ ] Risk tiering methodology - [ ] Assessment requirements - [ ] Ongoing monitoring requirements - [ ] Termination procedures - [ ] Roles and responsibilities

Vendor Security Requirements: - [ ] Minimum security standards - [ ] Data protection requirements - [ ] Incident notification requirements - [ ] Audit rights - [ ] Subcontractor requirements - [ ] Insurance requirements

Supporting Procedures: - [ ] Vendor onboarding procedure - [ ] Assessment procedure - [ ] Risk acceptance procedure - [ ] Exception handling procedure - [ ] Termination procedure

Policy Approval Process: 1. Draft policy development 2. Stakeholder review 3. Legal review 4. Risk committee approval 5. Executive sign-off 6. Communication and training

Duration: 4-6 weeks

Step 4: Vendor Inventory Creation¶

Objective: Establish comprehensive vendor inventory

Inventory Data Elements: | Field | Description | Required | |-------|-------------|----------| | Vendor name | Legal entity name | Yes | | Business owner | Relationship manager | Yes | | Contract reference | Agreement identifier | Yes | | Risk tier | 1-4 classification | Yes | | Data classification | Data accessed | Yes | | Service description | What vendor provides | Yes | | Contract dates | Start, end, renewal | Yes | | Last assessment | Date and result | Yes | | Criticality rating | Business impact | Yes | | Regulatory scope | Applicable frameworks | Yes |

Inventory Sources: - Accounts payable vendor list - Contract management system - IT asset/application inventory - Procurement records - Department surveys

Inventory Process: 1. Gather vendor lists from all sources 2. Deduplicate and normalize 3. Assign business owners 4. Apply risk tiering 5. Identify assessment gaps 6. Prioritize for assessment

Duration: 3-6 weeks (depending on vendor count)

Step 5: Program Operationalization¶

Objective: Implement operational processes for VRM

Operational Workflows:

New Vendor Onboarding: 1. Business case submission 2. Initial risk classification 3. Due diligence (tier-appropriate) 4. Assessment completion 5. Risk review and decision 6. Contract execution 7. Inventory update 8. Monitoring enrollment

Vendor Renewal: 1. Renewal notification (90 days) 2. Reassess risk tier 3. Update assessment 4. Review performance/issues 5. Renewal decision 6. Contract update

Vendor Termination: 1. Termination notice 2. Data return/destruction 3. Access revocation 4. Final invoice processing 5. Lessons learned 6. Inventory update

Resource Requirements: | Vendor Count | FTE Estimate | Tool Requirement | |--------------|--------------|------------------| | <50 | 0.25 | Spreadsheet | | 50-200 | 0.5-1.0 | GRC tool recommended | | 200-500 | 1-2 | GRC tool required | | 500+ | 2+ | Enterprise GRC |

Duration: 4-6 weeks

Step 6: Metrics and Reporting¶

Objective: Establish program performance measurement

Program Metrics: | Metric | Target | Frequency | |--------|--------|-----------| | Vendor inventory completeness | 100% | Monthly | | Tier 1 assessment completion | 100% | Quarterly | | Overall assessment completion | >90% | Quarterly | | Overdue assessments | <5% | Monthly | | Issues remediated on time | >80% | Monthly | | Average time to onboard | <30 days | Monthly | | Risk acceptance rate | <10% | Quarterly |

Executive Reporting: - Monthly: Operational dashboard - Quarterly: Program status report - Annual: Program maturity assessment

Report Content: - [ ] Vendor portfolio overview - [ ] Risk distribution by tier - [ ] Assessment status - [ ] Open issues and remediation - [ ] Incidents involving vendors - [ ] Program roadmap progress

Duration: Ongoing (4-6 hours monthly)

Deliverables¶

Deliverable	Format	Owner
VRM Program Charter	Word/PDF	Engagement Manager
VRM Policy	Word/PDF	Lead Consultant
Risk Tiering Framework	Word/Excel	Lead Consultant
Vendor Inventory	Excel/GRC	Technical Analyst
Process Documentation	Word	Lead Consultant
Executive Dashboard	PPT/Dashboard	Engagement Manager
Program Metrics Report	PDF	Engagement Manager

Quality Gates¶

Governance structure approved and operational
Risk tiering methodology documented and applied
VRM policy approved by executive sponsor
Vendor inventory complete with risk tiering
Operational workflows documented and tested
Metrics tracking in place
Executive reporting established
Training provided to stakeholders

Last Updated: February 2026