Requirement
The entity assesses and manages risks associated with vendors and business partners.
Points of Focus
Establishes Requirements for Vendor and Business Partner Engagements
Requirement: The entity establishes specific requirements for vendor and business partner engagements that include (1) scope of services and product specifications, (2) roles and responsibilities, (3) compliance requirements, and (4) service levels.
Identifies Vulnerabilities
Requirement: The entity evaluates vulnerabilities arising from vendor and business partner relationships, including third-party access to the entity’s IT systems and connections with third-party networks.
Assesses Vendor and Business Partner Risks
Requirement: The entity inventories, tiers, and assesses, on a periodic basis, threats arising from relationships with vendors and business partners (and those entities’ vendors and business partners) and the vulnerability of the entity's objectives to those threats. Examples of threats arising from relationships with vendors and business partners include those arising from their (1) financial failure, (2) security vulnerabilities, (3) operational disruption, and (4) failure to meet business or regulatory requirements.
Assigns Responsibility and Accountability for Managing Vendors and Business Partners
Requirement: The entity assigns responsibility and accountability for the management of risks and changes to services associated with vendors and business partners.
Establishes Communication Protocols for Vendors and Business Partners
Requirement: The entity establishes communication and resolution protocols for service or product issues related to vendors and business partners.
Establishes Exception Handling Procedures From Vendors and Business Partners
Requirement: The entity establishes exception handling procedures for service or product issues related to vendors and business partners.
Assesses Vendor and Business Partner Performance
Requirement: The entity assesses the performance of vendors and business partners, as frequently as warranted, based on the risk associated with the vendor or business partner.
Implements Procedures for Addressing Issues Identified During Vendor and Business Partner Assessments
Requirement: The entity implements procedures for addressing issues identified with vendor and business partner relationships.
Implements Procedures for Terminating Vendor and Business Partner Relationships
Requirement: The entity implements procedures for terminating vendor and business partner relationships based on predefined considerations. Those procedures may include safe return of data and its removal from the vendor or business partner system.
[C] Obtains Confidentiality Commitments From Vendors and Business Partners
Requirement: The entity obtains confidentiality commitments that are consistent with the entity’s confidentiality commitments and requirements from vendors and business partners who have access to confidential information.
[C] Assesses Compliance With Confidentiality Commitments of Vendors and Business Partners
Requirement: On a periodic and as-needed basis, the entity assesses compliance by vendors and business partners with the entity’s confidentiality commitments and requirements.
[P] Obtains Privacy Commitments From Vendors and Business Partners
Requirement: The entity obtains privacy commitments, consistent with the entity’s privacy commitments and requirements, from vendors and business partners who have access to personal information.
[P] Assesses Compliance With Privacy Commitments of Vendors and Business Partners
Requirement: On a periodic and as-needed basis, the entity assesses compliance by vendors and business partners with the entity’s privacy commitments and requirements and takes corrective action as necessary.
Explanation
Vendors and business partners can introduce risk just as employees can. This criterion requires defined engagement requirements, periodic risk assessments, assigned ownership, performance monitoring, and orderly termination procedures — plus confidentiality and privacy commitments where third parties handle sensitive data. Auditors expect a vendor inventory with risk tiers and assessment evidence.
