Why this matters: Proper vendor management protects NESP from operational disruption, secures sensitive data, and ensures strict regulatory compliance across the enterprise.
Attention Activity: The Hidden Risk
A software vendor with direct remote access to our internal systems has suffered a breach. Because they were not subjected to our standard risk assessment protocol prior to onboarding, thousands of PII records have been exposed to threat actors.
This lesson will teach you how to prevent scenarios like this by diligently applying the NESP Vendor Management Policy across all vendor relationships.
Vendor Selection & Governance
NESP aims to standardize technology platforms and reduce system variations. This targeted approach increases our buying power and enables us to partner closely with strategic vendors rather than managing countless disconnected suppliers.
While vendor selection is often done ad hoc based on reputation, experience, and trade research, the Principal (CEO) makes the final decision on all third-party selections.
Vendor Governance Committee
Click each card to view the specific responsibilities of the committee members.
Risk Rating Criteria
All vendors must be inventoried and assigned a risk rating based on their level of interaction with our organization. Vendors representing an increased risk are required to provide a SOC II report (or equivalent), which must be reviewed annually.
Check all conditions that apply to this vendor to determine their risk rating.
Knowledge Check
According to the policy, which of the following is a criterion for risk rating a vendor?
Contract Negotiation & Review
Every Third Party must be assigned a specific Third Party Owner (a staff member or manager in IT/Operations) who will manage the day-to-day relationship. They are also responsible for reviewing the agreement on an annual basis.
Importantly, the NESP legal counsel representative must review all Third-Party agreements prior to signature.
Click to expand and view how certain clauses should be handled during contract negotiations:
- Clear Service Level Agreement (SLA) terms.
- Technology, insource, and outsource outs clauses.
- Confidentiality and Non-Disclosure clauses.
- Privacy protection clauses (if accessing customer information).
- Standard liability insurance provisions.
- Automatic cost increases.
- Automatic agreement renewals.
- Force majeure clauses.
- Aggressive termination restrictions (e.g., demanding 6 months' notice not to renew).
Connectivity & Enforcement
Third-party remote access to internal NESP systems presents a significant security attack vector. Strict protocols govern this access to prevent unauthorized exposure.
Policy Enforcement
- Vendors: Policy violations can result in immediate termination of their contract.
- Employees: Violations are subject to disciplinary action, up to and including immediate termination of employment.
Knowledge Check
Who must review all Third-Party agreements before an NESP representative signs the contract?
Key Takeaways
Before proceeding to the final assessment, review these core principles of the Vendor Management Policy:
- Centralized Oversight: The Principal (CEO) makes the final decision on vendor selection and system connectivity.
- Risk Management: All vendors must be risk-rated. High-risk vendors (due to data access or spend) must provide a SOC II report.
- Contract Controls: Legal counsel must review all contracts. Risky clauses (like auto-renew) belong in an appendix, while strict NDAs and SLAs belong in the main contract.
- System Security: Remote access requires InfoSec approval, must be strictly limited, monitored, and audited.
- Strict Enforcement: Non-compliance leads to immediate contract termination for vendors and disciplinary action for employees.
Knowledge Assessment
You have completed the tutorial section. Next, you will take a short assessment to verify your understanding of the NESP Vendor Management Policy.
- There are 4 multiple-choice questions.
- You must score at least 80% to pass and earn your certificate.
- You can retake the assessment if necessary.
Click Next to begin.
Who makes the final decision on the selection of Third Parties according to the policy?
A vendor proposes a contract with an automatic renewal clause and a six-month notice to terminate. How should NESP handle this?
Which of the following conditions mandates that a vendor provide a SOC II report (or equivalent)?
A vendor needs remote access to an internal NESP system to perform maintenance. What is the required procedure?