Tag
Vendor Risk
33 articles
Compliance frameworks
CMMC and cloud services: FedRAMP equivalency
When a cloud service holding CUI must be FedRAMP Moderate authorized or equivalent, what equivalency requires, and what to collect from your provider.
6 min read
Risk and vendors
Vendor security questionnaires that get answers
How to design and send vendor security questionnaires that come back complete: sizing by tier, reusing reports, writing answerable questions, and follow-up.
6 min read
AI governance
Shadow AI: finding the tools your teams already use
Where to look for unapproved AI tools: identity grants, expenses, browser extensions, network logs, features in existing SaaS, code. Then how to triage.
6 min read
Privacy
Managing sub-processors and the notice customers expect
What GDPR Article 28 requires for sub-processors, who counts as one, how to run the list and change notices, and what to do when a customer objects to a change.
6 min read
Trust and sales
Security addendums and what to negotiate
A clause-by-clause guide to a customer's security addendum: incident notice, audit rights, prescribed controls, subprocessors, deletion, and liability.
6 min read
Compliance frameworks
CMMC for subcontractors in the defense supply chain
How CMMC reaches subcontractors through flow-down, why the level you need follows the information you receive, and what to settle with your prime first.
5 min read
Risk and vendors
Managing SaaS sprawl
How to find the SaaS apps your teams already use, triage them into an owned inventory, retire the extras, and stop new sprawl without blocking the business.
6 min read
AI governance
Keeping an AI system inventory
What belongs in an AI system inventory, the fields worth keeping, where entries come from, and the change triggers that stop it going stale in months.
6 min read
Risk and vendors
Continuous vendor monitoring
What to watch between annual vendor reviews: report expiry, incidents, sub-processor and usage changes, what each signal should trigger, and cadence by tier.
6 min read
Compliance frameworks
Accredited certification bodies and why accreditation matters
How accreditation of ISO 27001 certification bodies works, what it does and does not guarantee, how to verify a certificate, and how to choose a body.
6 min read
Compliance frameworks
Student data privacy agreements, explained
What a student data privacy agreement contains, why districts require one, how standardized agreements work, and which clauses need operational work first.
6 min read
Compliance frameworks
How to read a SOC 2 report as a buyer
A buyer's order for reading a vendor's SOC 2 report: the opinion, period, scope, carve-outs, user entity controls, and test results, and what to record.
6 min read
Risk and vendors
Offboarding a vendor
How to offboard a vendor: inventory what it holds, export data, revoke every credential and DNS record, confirm deletion, update records, and keep evidence.
6 min read
Compliance frameworks
DORA contract requirements for ICT services
The clauses DORA Article 30 requires in every ICT services contract, the extra terms for critical or important functions, and what providers should negotiate.
7 min read
Compliance frameworks
What a SOC 2 bridge letter is and when buyers ask for one
What a SOC 2 bridge letter covers, who signs it, why it carries no auditor assurance, when buyers ask for one, and how to keep the gaps it covers short.
6 min read
Risk and vendors
Fourth-party risk, explained
What fourth-party risk is, where your vendors' vendors show up in SOC 2 reports and sub-processor lists, what GDPR and ISO 27001 expect, and what to do.
6 min read
AI governance
AI vendor risk: questions to ask before you adopt a model
The questions to add to vendor due diligence before adopting an AI model or AI feature: data use, retention, hosting, model changes, incidents, contracts.
6 min read
Compliance frameworks
Carve-out vs inclusive: subservice organizations in SOC 2
How the carve-out and inclusive methods treat subservice organizations in a SOC 2, when each one fits, and the monitoring controls a carve-out requires.
6 min read
Trust and sales
Answering due diligence questionnaires
What a vendor due diligence questionnaire asks beyond security, who should own each section, and how to handle financials, continuity and signed attestations.
6 min read
Compliance frameworks
FERPA for EdTech vendors
FERPA regulates schools, not vendors, yet it shapes every EdTech contract. How it reaches you, what counts as an education record, and the controls to run.
6 min read
Compliance frameworks
Complementary user entity controls, explained
What complementary user entity controls are, why SOC 2 reports list them, how to write ones auditors and buyers accept, and what to do with a vendor's list.
6 min read
Risk and vendors
A vendor due diligence checklist
A pre-contract vendor due diligence checklist: assurance reports, data handling, access, incidents, contract terms, sub-processors and the approval record.
6 min read
Trust and sales
Handling an enterprise security review
A stage-by-stage playbook for an enterprise security review: intake questions, the standard package, the questionnaire, follow-up calls, and findings.
6 min read
Compliance frameworks
DORA third-party risk and the register of information
How DORA's Articles 28 and 29 govern ICT third-party risk, what the register of information must hold, and how to assess, monitor and exit ICT providers.
6 min read