Vendor Risk
Critical and high-risk vendors are reassessed and monitored based on risk, incidents, service changes, contract renewals, and control reliance.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
Critical and high-risk vendors remain acceptable after onboarding because the company detects assurance changes, incidents, service deterioration, control concerns, and expanded use, then responds based on risk.
First SOC 2 program
Set an annual review date for critical and high-risk vendors and subscribe to their security advisories and status notices. At each review, obtain current assurance information, compare it with the prior year, revisit open findings, and confirm that data use and service reliance have not changed.
As the company scales
Combine scheduled reassessment with continuous signals, contract renewal, architecture change, incident, financial-health, and performance workflows, routing material changes to vendor-risk, security, resilience, privacy, and business owners.
For each vendor tier, define reassessment frequency, required updated evidence, monitored signals, trigger events, accountable reviewers, and escalation thresholds.
You should end up with: A monitoring plan and next-review date for every critical and high-risk vendor.
Monitor security advisories, status events, incidents, assurance expirations, control findings, contract renewals, service performance, ownership changes, and significant scope changes.
You should end up with: Dated monitoring records with source, affected vendor, signal, and disposition.
Obtain current assurance material, confirm the vendor profile and tier, reassess relevant findings, and verify that the reviewed evidence still covers the service in use.
You should end up with: A completed reassessment with current scope, evidence, findings, tier, and risk decision.
Identify new report exceptions, expired certifications, changed external providers, incidents, reduced coverage, new data use, or greater service dependence since the prior review.
You should end up with: A documented change analysis linked to updated risk and required actions.
Open findings, require vendor remediation, add safeguards, update contracts, reclassify the vendor, invoke continuity plans, or escalate continued use for risk acceptance as appropriate.
You should end up with: A traceable decision and action record for each material concern.
Summarize overdue reviews, expired evidence, open high-impact findings, concentration, incidents, and risk decisions for management and service owners.
You should end up with: A periodic vendor-risk dashboard with decisions and assigned follow-up.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
Confirm what the record proves
Critical and high-risk vendors received a scheduled reassessment of current use, tier, assurance, findings, incidents, service performance, and continued acceptability.
Include this context
vendor and review identifier
Include this context
tier and review period
Include this context
reviewer and completion date
Include this context
current-use and scope confirmation
Include this context
findings and changes
Include this context
decision and next review date
Weak evidence to avoid
A vendor record whose review date was advanced one year with no updated evidence, scope confirmation, findings comparison, reviewer, or continued-use decision.
Confirm what the record proves
Updated service-auditor reports were assessed for current scope, opinion, exceptions, subservice organizations, complementary responsibilities, bridge-period considerations, and impact on vendor risk.
Include this context
vendor service and report period
Include this context
scope and opinion
Include this context
exceptions and vendor response
Include this context
subservice and user responsibilities
Include this context
reviewer and review date
Include this context
risk impact and actions
Weak evidence to avoid
A newly uploaded report with an updated reviewed date but no comparison of scope, exceptions, complementary responsibilities, coverage gap, or risk impact.
Confirm what the record proves
Vendor outage and security-advisory signals were monitored, assessed against company use and dependency, and escalated when material.
Include this context
vendor and monitored source
Include this context
event or advisory identifier
Include this context
published and reviewed timestamps
Include this context
affected vendor service
Include this context
company impact decision
Include this context
disposition or escalation
Weak evidence to avoid
An inbox subscription full of unread vendor notices with no review timestamps, affected-service mapping, impact decision, owner, or escalation record.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
Confirm what the record proves
Scheduled and event-driven vendor signals were collected and dispositioned, including evidence expirations, incidents, service changes, findings, and contract milestones.
Include this context
vendor and signal type
Include this context
source and event date
Include this context
monitoring or review date
Include this context
owner
Include this context
materiality result
Include this context
action and closure status
Weak evidence to avoid
A list of automated vendor ratings with no review owner, threshold, affected service, disposition, or evidence that a major score change was investigated.
Type 1
Current monitoring requirements by tier, current critical and high-risk monitoring calendar, configured alert sources, and one recently completed reassessment with change analysis as of the examination date.
Type 2
All scheduled reassessments due for critical and high-risk vendors and every incident, assurance expiration, material rating change, service change, contract renewal, or advisory signal requiring review during the period.
Reconcile the high and critical vendor population to the monitoring calendar, assurance expiration dates, incidents, renewals, and subscribed signals, then verify each due or triggered item has a documented disposition and completed follow-up.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: Critical and high-risk vendors remain acceptable after onboarding because the company detects assurance changes, incidents, service deterioration, control concerns, and expanded use, then responds based on risk.
Compare the documented owner with the intended role (Vendor Risk Owner / CISO / Legal), then compare dated records with the stated cadence: Prior to onboarding; periodic based on risk; at least annually for critical/high.
Reconcile the high and critical vendor population to the monitoring calendar, assurance expiration dates, incidents, renewals, and subscribed signals, then verify each due or triggered item has a documented disposition and completed follow-up.
Current monitoring requirements by tier, current critical and high-risk monitoring calendar, configured alert sources, and one recently completed reassessment with change analysis as of the examination date.
All scheduled reassessments due for critical and high-risk vendors and every incident, assurance expiration, material rating change, service change, contract renewal, or advisory signal requiring review during the period.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
For each selected record, confirm it demonstrates Critical and high-risk vendors received a scheduled reassessment of current use, tier, assurance, findings, incidents, service performance, and continued acceptability.
For each selected record, confirm it demonstrates Updated service-auditor reports were assessed for current scope, opinion, exceptions, subservice organizations, complementary responsibilities, bridge-period considerations, and impact on vendor risk.
For each selected record, confirm it demonstrates Vendor outage and security-advisory signals were monitored, assessed against company use and dependency, and escalated when material.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
For each selected record, confirm it demonstrates Scheduled and event-driven vendor signals were collected and dispositioned, including evidence expirations, incidents, service changes, findings, and contract milestones.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.