Your vendors hold your data. Can you say which ones?

Vendor security is not one problem. It is five, and most organizations have solved one of them at best.

1. You do not know every vendor you have. Expense-card subscriptions, free tools a department signed up for, and the contractor who was given a login never reach the list.

2. You treat every vendor the same. The office snack service and the managed IT provider with domain admin rights get the same questionnaire, or none at all.

3. You collect evidence but cannot judge it. A SOC 2 report arrives and is filed. Nobody checks what it covers, what exceptions it lists, or which controls it expects you to run.

4. Nothing happens after the contract is signed. No review date, no follow-up on findings, no record of the risks you accepted, and access left open after the vendor is gone.

5. You cannot prove any of it. No policy leadership approved, no security terms in the contract, and nothing to hand an auditor, a customer or an insurer.

START HERE, FREE

Twenty-one statements, ten minutes, and a self-scoring workbook. The Vendor Security Quick Assessment scores you on parts 1 to 4 and places you at Foundational, Developing or Managed. It shows your weakest part on its own, because that is where a vendor program fails, and it gives you the first move for the next thirty days.

Measures: parts 1 to 4.

Solves: none of them, on purpose. It tells you where to start.

VENDOR SECURITY STARTER KIT, $9

Two weeks of setup turns "we think we have about forty vendors" into an owned, classified and prioritized list, and keeps it current in thirty minutes a month. Plain yes or no questions classify each vendor's data and access and suggest its tier, so the debate is short.

Solves part 1. One inventory with an owner for every vendor, built from the places vendors hide.

Solves part 2. Data and access classification and a criticality score put the vendors that can hurt you at the top.

Starts part 3. An evidence request template and tracker get answers back from the vendors that matter. Judging what they send is in the Toolkit.

Starts part 4. A review calendar, a basic remediation tracker and an offboarding checklist. Exceptions and validated closure are in the Toolkit.

Still open: part 5. Nothing here proves the program to anyone else yet.

THIRD-PARTY SECURITY MANAGEMENT TOOLKIT, $39 AT LAUNCH

This is where most vendor programs fail, and where the Toolkit does most of its work. Everything runs in one nine-tab workbook with worked examples, and a six-week rollout plan in the implementation guide.

Solves parts 1 and 2, more rigorously. Criticality is scored across six factors with two override rules, so a vendor holding restricted data or privileged access can never average its way down to a low tier.

Solves part 3. Twelve evidence types, a SOC 2 review worksheet, and a guide to reading what vendors send: report scope, opinions, exceptions and the controls a report expects you to run, plus what to look for in managed IT, payroll, cloud hosting, payment and AI vendors.

Solves part 4. Findings are tracked to validated closure, exceptions carry an approver and an expiry date, a twelve-month review calendar shows what is due, and offboarding is checked off rather than remembered.

Starts part 5. A dashboard and a signed risk acceptance form give you evidence of the work. There is no approved policy or contract language yet.

THIRD-PARTY RISK PROGRAM-IN-A-BOX, $129 AT LAUNCH

The Toolkit runs the work. The Program adds the authority behind it, and it closes the last part of the problem. Adopt it in ninety days with the rollout plan, responsibility matrix and governance calendar in the implementation guide.

Solves parts 1 to 4, with the full Toolkit workbook, extended with program metrics, metric history and questionnaire scoring.

Solves part 5. A charter that says who decides, a policy for leadership to approve, a classification standard with explicit tier rules, and four procedures for due diligence, ongoing monitoring, annual review and offboarding. A 54-question vendor questionnaire, split by tier, and contract security requirements with example clause language for each tier close the gap at signing. A metrics standard and a quarterly report template give leadership a number every quarter.

Aligned to NIST CSF 2.0 GV.SC, CIS Controls v8.1 Control 15 and ISO/IEC 27001:2022 controls 5.19 to 5.23, with a crosswalk included. It supports those requirements; it does not certify against them.