Section 22: Vendor Management

Vendor Assessment

the process of evaluating and monitoring security risks associated with third-party service providers.

Right-to-audit Clause

in vendor contracts grants the org the right to conduct or have conducted on its behalf an audit of the vendor’s security practices

Vendors should provide evidence of regular internal audits of their security processes and controls

True

Independent Assessments

done by third-party and is an objective evaluation

Rules of Engagement

the set of guidelines or protocols that outline how an org interacts and cooperates with third-party vendors

Due Diligence

comprehensive appraisal of a vendor’s business practices, focusing on their cybersecurity policies, procedures, and controls. It aims to uncover any potential security vulnerabilities or weaknesses in the vendor.

SLA

a contact between a service provider and a client that specifies the level of service expected during the term of the agreement. Includes things like system uptime, response times for support requests and security measures.

SLAs are crucial for

establishing performance benchmarks and consequences for not meeting agreed standards.

Memorandum of Agreement (MOA)

a formal document outlining an agreement between two or more parties. Often used to establish cooperative agreements.

MOA can set out joint initiatives for

info sharing and collab development of security protocols.

Memorandum of Understanding (MOU)

less formal than a MOA and is typically used to outline a mutual agreement on a shared goal or project without legal obligations.

Master Service Agreement (MSA)

a comprehensive contract that sets the general terms governing future transactions or agreements. It can streamline future agreements and often includes clauses on confidentiality, dispute, resolutions and data security standards.

Work Order/ Statement of Work (WO and SOW)

document that provides specific details about the work to be performed under a contract.

Business Partner Agreement (BPA)

outlines the terms and conditions of the relationship between business partners.