Vendor Risk Management Policy

Document Version: 1.0
Last Reviewed: July 19, 2025
Owner: Compliance & Risk Officer

1. Purpose

This policy defines the framework for assessing, onboarding, and monitoring third-party vendors to ensure their services meet DevSecOpsBook’s security, availability, confidentiality, and privacy obligations as outlined in SOC 2.

2. Scope

This policy applies to all third-party vendors, contractors, cloud providers, service partners, and outsourced service providers that store, process, or transmit customer or company data, or provide critical IT or business functions.

3. Policy

3.1 Vendor Risk Classification

• Vendors shall be classified based on the criticality of services and data sensitivity:
  • Tier 1: Access to production systems or sensitive customer data.
  • Tier 2: Internal support services (e.g., HR tools, finance platforms).
  • Tier 3: No access to sensitive systems or data.

3.2 Vendor Due Diligence

• Prior to engagement, Tier 1 and Tier 2 vendors must undergo a documented due diligence review, including:
  • Security certifications (SOC 2 Type II, ISO 27001, etc.)
  • Data protection policies
  • Breach history and incident response processes
  • Financial viability

3.3 Contractual Requirements

All vendor agreements must:

• Include data protection clauses, confidentiality terms, and breach notification timelines.
• Define security requirements aligned with DevSecOpsBook’s standards.
• Require vendors to notify DevSecOpsBook of any sub-processors.

3.4 Ongoing Monitoring

• Tier 1 vendors must be reviewed annually for compliance through:
  • Audit reports (e.g., SOC 2)
  • Security questionnaire re-evaluation
  • Breach disclosures or service degradation incidents
• Tier 2 vendors are reviewed biennially.
• Tier 3 vendors may be monitored ad hoc or as needed.

3.5 Termination and Offboarding

• Upon termination of a vendor relationship:
  • Access must be revoked immediately.
  • Data must be returned or securely deleted within 30 days.
  • An offboarding checklist must be completed and archived.

3.6 Incident Reporting

• Vendors must promptly notify DevSecOpsBook of:
  • Security incidents or data breaches (within 72 hours)
  • Any changes to service scope, sub-processors, or terms

3.7 Recordkeeping

• All vendor assessments, contracts, audit results, and communications must be retained for a minimum of 3 years and made available for audit upon request.

4. Roles and Responsibilities

Role	Responsibility
Compliance Officer	Approve risk classifications and conduct annual reviews
Procurement Team	Enforce contract requirements and track vendor status
Engineering & IT	Manage technical access and integration reviews

5. Policy Review

This policy shall be reviewed annually or upon significant changes to business operations or regulatory requirements.