Vendor & Third-Party Management

Frequently Asked Questions About Vendor Management

What is the difference between vendor management and third-party risk?

Third-party risk is the risk that arises because you depend on others, such as suppliers, data processors and partners. Vendor management is the process you use to control it: registration, assessment, agreements and ongoing follow-up.

What does ISO 27001 require for vendor management?

ISO 27001:2022 has five Annex A controls (5.19–5.23) on supplier relationships. They cover security requirements in agreements, ICT supply chain security, ongoing monitoring of supplier services and security in the use of cloud services.

How do you assess a vendor’s security in NorthGRC?

You send a questionnaire to the vendor’s contact person via a secure link. NorthGRC provides templates based on ISO 27002 and ISAE 3000, among others, and you can adapt the questions and define which answers are acceptable, so responses can be compared.

How do we keep track of data processing agreements and contracts?

Agreements such as data processing agreements, contracts and SLAs are registered on each vendor with a start and end date. About a month before the end date, the person responsible for the vendor receives a reminder to review the agreement.

Table of content

Table of content

Vendor Management with Connected Oversight of Third-Party Risk

What Is Vendor Management?

ISO 27001

GDPR

NIS2

One Source of Truth for Vendors, Contracts, and DPAs

Standardised Vendor Due Diligence without Manual Chasing

Turn Vendor Responses into Clear Risk Insight

Full Context through Integrated History and Incidents

Audit-Ready Documentation without Last-Minute Effort

Frequently Asked Questions About Vendor Management

What is the difference between vendor management and third-party risk?

What does ISO 27001 require for vendor management?

How do you assess a vendor’s security in NorthGRC?

How do we keep track of data processing agreements and contracts?

Ready to make GRC an integrated part of your daily operations?