What is vendor management?
Vendor management governs how an organisation selects external providers, binds them by contract, monitors them and replaces them. Its principle: buying a service relocates the work, not the duty.
In German law the requirement sits in § 30(2) sentence 2 no. 4 of the BSI Act (BSIG). The entry on supply chain security covers the duties for the supply chain as a whole. Third-party risk management (TPRM) describes the same task from the risk perspective.
Which rules require vendor management?
Four sets of rules require a managed relationship with providers, each within its own scope:
| Framework | Provision | Requirement |
|---|---|---|
| NIS2 | Directive (EU) 2022/2555, Article 21(2)(d); § 30(2) sentence 2 no. 4 BSIG | supply chain security, including the relationships with direct suppliers and service providers |
| DORA | Regulation (EU) 2022/2554, Chapter V Section I, Articles 28 to 30 | management of ICT third-party risk, register of information, minimum contractual content |
| GDPR | Article 28 of Regulation (EU) 2016/679 | selection of processors offering sufficient guarantees, a contract with defined content |
| ISO/IEC 27001 | Annex A 5.19 to 5.22 | supplier relationships from security requirements through the contract to monitoring |
The detail differs; the underlying idea does not: traceable selection, a clear contractual basis, ongoing monitoring, an orderly exit.
The direct provider is the lever, not the boundary
§ 30(2) sentence 2 no. 4 BSIG requires "security of the supply chain, including security-related aspects of the relationships with direct suppliers or service providers". What is owed is the security of the supply chain; the relationship with the direct provider is expressly part of it, not its boundary. You reach deeper tiers through the direct contracting party, by having requirements, information duties and audit rights passed down contractually.
What are the tasks of vendor management?
The tasks follow the lifecycle of a service in five phases:
- Need and classification: decide which function the provider will support and how critical it is. This classification sets the depth of every later step.
- Assessment before signing: check suitability, security posture, financial stability, locations and subcontractors.
- Contract: set out service obligations, security requirements, and information, audit and termination rights.
- Operation and monitoring: evaluate performance data, reports and incidents, and track changes to locations, subcontractors or ownership.
- Termination: bring data and tasks back under a prepared exit strategy.
Criticality sets the depth of review
An assessment depth that is identical for every supplier is too thin for the critical ones or too costly for the rest. Criticality follows from four features: the importance of the processes supported, the nature of the data accessible, how replaceable the provider is and how deep its system access runs. The organisation decides how many tiers it uses.
Justify the classification in writing and revisit it on a cycle. If a provider takes on further tasks one at a time, its criticality rises without anyone having decided so.
What does the contract have to secure?
The contract is where requirements on a provider become enforceable. Six areas belong in it:
| Area | Purpose |
|---|---|
| Security requirements and evidence | measurable requirements instead of statements of intent |
| Notification of security incidents | you learn in time what triggers your own reporting deadlines |
| Audit and information rights | your own assessment, or the production of third-party reports |
| Subcontracting | approval, notification, and passing your requirements down the chain |
| Locations and data locations | the basis for assessing processing in legal terms |
| Termination and return | termination rights, cooperation, data handed back in a usable form |
The incident notification clause must fit your own deadlines. The early initial notification under § 32(1) no. 1 BSIG is due no later than 24 hours after becoming aware. A contractual notification period of several days for the provider makes that deadline unachievable.
Monitoring: scoped evidence and a decision
Certificates and third-party assurance reports are legitimate evidence, but they carry only as far as their scope reaches. Check the scope rather than the existence of the certificate. Supplement it with evidence from the working relationship: service levels met, incidents reported, handling times and results of recovery tests.
Assess critical providers yourself as well, documented and on a fixed cycle. The outcome triggers a decision: continue, impose conditions, or exit.
Vendor management and outsourcing are not the same thing
Outsourcing is a supervisory term; for institutions in Germany, § 25b of the German Banking Act (KWG) governs it. Vendor management, by contrast, covers every external service:
| Criterion | Vendor management | Outsourcing under § 25b KWG |
|---|---|---|
| Scope | any external supply of a service | outsourcing of activities and processes to another company |
| Register | as needed; under DORA, the register of information | outsourcing register with all material and non-material outsourcings (subsection 1) |
| Contract | depending on criticality | written agreement with rights of instruction and termination (subsection 3) |
| Responsibility | stays with the client | stays with the institution; the managers' responsibility does not transfer (subsection 2) |
Every outsourcing arrangement is therefore a case for vendor management, but not every managed provider is an outsourcing arrangement. The classification is its own documented step and does not belong to procurement alone, because it carries a supervisory judgement.
Five points where vendor management breaks down
Vendor management breaks down at five points:
- The business function contracts without a security assessment.
- The contract regulates pricing in detail and security in one sentence.
- Subcontractors remain unknown.
- Monitoring consists of collecting certificates once a year.
- The exit gets planned only when it becomes necessary, under time pressure.
The supplier security checklist walks through every phase, from the inventory through the assessment before signing to the exit.
Providers as supporting assets in Rizzqo
In Rizzqo, a provider is a supporting asset in the asset register; it inherits the confidentiality rating and the personal-data flag from the business processes linked to it. If a provider's contract lacks an audit or notification clause, Rizzqo carries the renegotiation as a task with an owner. Its planned risk reduction is applied only when the task is completed.
DORA and ISO/IEC 27001 are held in Rizzqo as requirement catalogues; their requirements are answered, evidenced and finalised against the assets with name and timestamp. If the organisation assesses the missing clause as a risk, Rizzqo computes it from likelihood in percent and impact in euros. The task syncs both ways with Jira.