Vendor Risk
Vendor contracts include confidentiality, security, access, data handling, incident notification, subprocessor, return/destruction, and termination obligations where applicable.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
Vendor agreements contain security and data obligations proportionate to the service and risk, and the company can trace negotiated terms to the final signed version and operational owners.
First SOC 2 program
Work with qualified legal counsel to establish approved security and data clauses, then adjust them based on the vendor’s data, access, criticality, and role. Require security and legal approval for material deviations before signature.
As the company scales
Use contract workflows that select requirements by risk tier and processing role, route redlines to subject owners, record deviations and risk decisions, extract ongoing obligations, and trigger review at renewal or material change.
Use vendor tier, data categories, system access, service criticality, processing role, locations, and customer commitments to identify the security and data terms needed.
You should end up with: A documented clause-requirement decision for the specific vendor relationship.
Address confidentiality, safeguards, access, data use, incident notice, external providers, audit or assurance information, availability where relevant, data return or deletion, and termination obligations as applicable.
You should end up with: Proposed contract language aligned with the vendor’s actual service and risk.
Have legal, security, privacy, service, and business owners assess material redlines, clarify ambiguous terms, and record the effect of any accepted deviation.
You should end up with: A redline and approval trail showing how material security and data terms were resolved.
Confirm that the signed master agreement, data terms, security addendum, and incorporated documents contain the final approved language and correct parties.
You should end up with: A complete executed contract package linked to the vendor record.
Extract notice periods, reporting, review rights, certificates, service commitments, deletion duties, and renewal dates, then assign owners and reminders.
You should end up with: An obligation record with accountable owners, trigger dates, and completion evidence locations.
Review contractual coverage at renewal and when the vendor gains new data, access, product scope, locations, providers, or service criticality.
You should end up with: A renewal or change assessment with amendments or an approved decision that current terms remain appropriate.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Documents that define the control, its scope, ownership, and expected way of working.
Confirm what the record proves
The final binding agreement with the correct parties includes or incorporates the approved security, service, data, incident, and termination obligations applicable to the vendor relationship.
Include this context
vendor legal entity
Include this context
company contracting entity
Include this context
agreement and incorporated documents
Include this context
effective and renewal dates
Include this context
authorized signatures
Include this context
executed version
Weak evidence to avoid
An unsigned contract draft with accepted redlines but no signatures, effective date, incorporated security terms, or proof that it is the operative agreement.
Confirm what the record proves
The parties documented applicable processing roles, instructions, safeguards, external providers, transfer, incident, assistance, return, and deletion obligations for personal data.
Include this context
parties and processing roles
Include this context
processing subject and duration
Include this context
data and data-subject categories
Include this context
security and incident duties
Include this context
external-provider and transfer terms
Include this context
execution and effective date
Weak evidence to avoid
A data addendum downloaded from the vendor website with blank parties and annexes, no data categories, no execution evidence, and no link to the governing agreement.
Confirm what the record proves
Risk-based technical and organizational safeguards, assurance information, access, incident, resilience, and termination expectations are contractually documented.
Include this context
covered service and systems
Include this context
required safeguards
Include this context
assurance or review duties
Include this context
incident and resilience terms
Include this context
termination duties
Include this context
approval and execution status
Weak evidence to avoid
A standard security exhibit attached to the review ticket but omitted from the executed contract and not tailored to the vendor’s privileged production access.
Confirm what the record proves
The vendor is bound to limit use and disclosure of confidential information, protect it, control personnel access, and continue relevant duties after termination.
Include this context
definition of protected information
Include this context
permitted use and disclosure
Include this context
personnel access duties
Include this context
protection standard
Include this context
survival or termination treatment
Weak evidence to avoid
A mutual confidentiality clause that excludes customer data from its definition and says nothing about vendor personnel access or post-termination obligations.
Confirm what the record proves
The vendor’s use of onward providers is subject to approval or notice expectations, equivalent protections, responsibility, and relevant change or location conditions.
Include this context
authorization model
Include this context
notice method and timing
Include this context
flow-down obligations
Include this context
vendor responsibility
Include this context
change or objection process
Include this context
location or transfer conditions
Weak evidence to avoid
A clause allowing unrestricted third-party processing with no notice, flow-down safeguards, vendor responsibility, objection route, or location consideration.
Type 1
Current approved clause requirements by vendor risk and data role, configured contract-review workflow, and a current executed high-risk vendor agreement with extracted obligations as of the examination date.
Type 2
Every new vendor agreement, renewal, amendment, data addendum, security addendum, and material security or data redline completed or due during the review period for vendors subject to contractual security requirements.
Reconcile vendors requiring security or data terms to executed agreement packages, compare final documents to approved redlines and addenda, and trace every accepted deviation and ongoing duty to the risk and obligation records.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: Vendor agreements contain security and data obligations proportionate to the service and risk, and the company can trace negotiated terms to the final signed version and operational owners.
Compare the documented owner with the intended role (Vendor Risk Owner / CISO / Legal), then compare dated records with the stated cadence: Prior to onboarding; periodic based on risk; at least annually for critical/high.
Reconcile vendors requiring security or data terms to executed agreement packages, compare final documents to approved redlines and addenda, and trace every accepted deviation and ongoing duty to the risk and obligation records.
Current approved clause requirements by vendor risk and data role, configured contract-review workflow, and a current executed high-risk vendor agreement with extracted obligations as of the examination date.
Every new vendor agreement, renewal, amendment, data addendum, security addendum, and material security or data redline completed or due during the review period for vendors subject to contractual security requirements.
Documents that define the control, its scope, ownership, and expected way of working.
For each selected record, confirm it demonstrates The final binding agreement with the correct parties includes or incorporates the approved security, service, data, incident, and termination obligations applicable to the vendor relationship.
For each selected record, confirm it demonstrates The parties documented applicable processing roles, instructions, safeguards, external providers, transfer, incident, assistance, return, and deletion obligations for personal data.
For each selected record, confirm it demonstrates Risk-based technical and organizational safeguards, assurance information, access, incident, resilience, and termination expectations are contractually documented.
For each selected record, confirm it demonstrates The vendor is bound to limit use and disclosure of confidential information, protect it, control personnel access, and continue relevant duties after termination.
For each selected record, confirm it demonstrates The vendor’s use of onward providers is subject to approval or notice expectations, equivalent protections, responsibility, and relevant change or location conditions.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.