1
Rate risk by how a vendor touches your data
Sorts vendors into high, medium, or low risk based on how they access your data.
What This Resource Includes
A complete policy for managing vendor and contractor access to your data, covering how to assess risk, what to put in contracts, day-to-day controls, and how to close off access when the work is done.
2
Rules for every stage of the relationship
Clear requirements for setup, ongoing work, and offboarding, with who's responsible and by when.
3
Forms you can use right away
A risk questionnaire, contract clause checklist, setup and offboarding forms, and a vendor tracking log, all included.
Why Vendors Need Their Own Policy
Most data security policies are written with employees in mind. Vendors are different: they come and go on their own schedule, they often keep access longer than they should, and problems usually only turn up once you're already doing an audit. This template helps you get ahead of that, so gaps get caught before they turn into incidents.
- Match the level of control to how risky a vendor actually is, not to the size of the contract.
- Spell out who approves access, who's in charge of removing it, and how long it should last.
- Set clear deadlines for cutting off access and confirming data has been deleted once a vendor is done.
- Skip writing it from scratch: the contract language, checklists, and tracking log are already done for you.
