Vendor Management - How to Make Better Vendor Management Decisions

The talk covers vendor management, which the speaker notes goes by many names, including third-party risk management and supply chain management, and frames it as a business decision rather than a checkbox exercise. Vendor risk is placed within a broader hierarchy that runs from IT assets to vendors and business processes. Each vendor is scored on four factors: how sensitive the data it handles is, how much access it has to customer information, how many services it supplies, and how critical it is to operations.

Vendors are sorted into tiers, and most organizations have only a handful of truly critical ones. Review depth scales with tier. Higher tiers get fuller checks of SOC 2 Type 2 reports, continuity and incident response plans, insurance, and contracts, with the goal of spotting red flags. Contracts deserve close reading for termination rights, breach notification duties, and data ownership, since older agreements often lack modern language. Risk responses are described as accepting, resolving, changing, or transferring risk, while cyber insurance is treated as recovery, not risk reduction.

The talk closes with practical steps: document accepted risks, revisit critical contracts every year, map where data lives using data flow diagrams, and ask vendors how they use AI with customer data. Fourth-party risk is hard to manage directly, so the advice is to check whether vendors manage their own critical suppliers and to review public SOC reports for supplier names.