Which providers have to be monitored?

All those whose failure or misconduct would reach your processes, data or obligations. The depth follows criticality, not contract value. A small provider with administrative access to your systems can matter more than a large supplier with no access to data at all.

Is a provider's ISO 27001 certificate sufficient evidence?

It is a strong indicator, not complete evidence. The decisive point is the scope: it has to cover the service, the locations and the systems you actually use. Check as well that the certificate is valid and issued by an accredited body, and add evidence drawn from the working relationship.

How often should providers be reassessed?

There is no generally applicable interval. An annual cycle for critical providers and a longer one for the rest is common, each supplemented by event-driven reviews: security incidents, contract changes, a change of subcontractor, a change of ownership, or a noticeable drift in performance.

How does vendor management differ from outsourcing management?

Vendor management is the general term for handling external providers. Outsourcing management describes the narrower, supervisory case in which activities the organisation would otherwise perform itself are permanently transferred out. In regulated sectors, outsourcing attracts additional requirements.

Does the duty extend to subcontractors?

Yes, indirectly. You need to know who is involved in the chain and to have your requirements passed down contractually. Approval or objection rights for new subcontractors, plus a notification duty, are usual. Without those rights your oversight stops at your direct counterparty while your exposure does not.

Does vendor management need its own tool alongside the ISMS?

Not necessarily. In Rizzqo a provider sits in the same inventory as systems and sites, with a category, an owner and links to the processes depending on it. Criticality follows from those links, the requirements for the category appear on the object, and open items carry on as a risk or a task.

Vendor Management: Lifecycle and Obligations

Why this became a regulated subject

Buying a service relocates the work, not the duty. That principle now appears in several rulebooks at once. Directive (EU) 2022/2555 names the security of the supply chain and of relationships with suppliers expressly as part of the risk management measures. DORA governs ICT third-party risk in Chapter V of Regulation (EU) 2022/2554. The GDPR requires, for processors, selection on the basis of sufficient guarantees and a contract with defined content in Art. 28. ISO/IEC 27001 treats supplier relationships as a topic area of its own.

The detail differs; the underlying idea does not. Traceable selection, a clear contractual basis, ongoing monitoring, an orderly exit.

The lifecycle

Need and classification: which function is the provider going to support, and how critical is it? This classification governs everything after it.
Assessment before signing: suitability, security posture, references, financial stability, locations, subcontractors.
Contract: service obligations, security requirements, information, audit and termination rights.
Operation and monitoring: performance data, reports, incidents, changes to locations, sub-providers or ownership.
Termination: return of data and tasks under a prepared exit strategy.

The first step is the one organisations skip. Without a classification, steps two to five have nothing to scale against, and the programme defaults to treating everyone the same.

Criticality beats equal treatment

An assessment depth that is identical for every supplier is either too thin for the critical ones or too expensive for the rest. Two or three tiers are usual, derived from the importance of the processes supported, the nature of the data accessible, how replaceable the service is, and how deep the system access runs.

The classification should be justified in writing and revisited on a cycle. Providers migrate upward over time without anyone deciding that they should, usually because they pick up additional tasks one at a time, each too small to trigger a review.

What the contract has to secure

Area	Purpose
Security requirements and evidence	measurable requirements instead of statements of intent
Notification of security incidents	you learn in time to meet your own reporting deadlines
Audit and information rights	your own assessment, or the production of third-party reports
Subcontracting	approval, notification, and passing your requirements down the chain
Locations and data locations	the basis for assessing processing in legal terms
Termination and return	termination rights, cooperation, data handed back in a usable form

The incident notification clause deserves particular attention if any of your own reporting obligations run on short clocks. A contract that gives the provider a week to inform you is incompatible with a duty that gives you hours.

Monitoring that actually evidences something

Certificates and third-party assurance reports are a legitimate and efficient form of evidence, but they carry only as far as their scope reaches. Check the scope rather than the existence of the certificate, and supplement it with evidence from the working relationship: adherence to agreed service levels, incidents reported, handling times, results of recovery tests.

For critical providers, add an assessment of your own on a fixed cycle, documented, whose outcome triggers a decision: continue, impose conditions, or exit. An assessment that cannot produce any of those three outcomes is a report, not a control.

Where programmes fail

The business function contracts without a security assessment. The contract regulates pricing in detail and security in one sentence. Subcontractors remain unknown. Monitoring consists of collecting certificates once a year. And the exit gets planned when it becomes necessary, that is, under time pressure and from a poor negotiating position.

How Rizzqo carries providers in the inventory

Vendor management is often built beside information security, with its own list, its own questionnaires and its own scoring. In Rizzqo a provider is a supporting asset like a server or a site. It carries a category and subcategory, a named owner, and links to the business processes and information running through it. Criticality then follows from what hangs on the supplier rather than from a separate estimate.

Requirements from the frameworks held in the platform are dispatched by category, so an asset classified as a provider picks up the requirements written for providers, with evidence held against the object. What stays open can be carried as a risk assessment and worked off through tasks, which can be handled in Jira.

Browse all entries Back to top

Vendor Management