.

compliance/governance/vendor-management/SKILL.md

@@ -0,0 +1,73 @@
+---
+name: vendor-management
+description: Implement vendor risk management programs. Assess third-party security and maintain vendor inventory. Use when managing supplier security.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Vendor Management
+
+Manage third-party vendor security risks.
+
+## Vendor Assessment
+
+```yaml
+assessment_process:
+  1_identify:
+    - Catalog all vendors
+    - Classify by risk tier
+    
+  2_assess:
+    - Security questionnaire
+    - SOC 2 review
+    - Penetration test results
+    
+  3_contract:
+    - Security requirements
+    - Data processing agreement
+    - SLAs
+    
+  4_monitor:
+    - Continuous monitoring
+    - Annual reassessment
+    - Incident notification
+```
+
+## Risk Tiers
+
+| Tier | Criteria | Assessment |
+|------|----------|------------|
+| Critical | Access to sensitive data | Full assessment, annual |
+| High | Significant data access | Questionnaire + SOC 2 |
+| Medium | Limited data access | Security questionnaire |
+| Low | No data access | Basic due diligence |
+
+## Security Questionnaire
+
+```yaml
+categories:
+  governance:
+    - Security policies
+    - Risk management
+    - Compliance certifications
+    
+  technical:
+    - Access controls
+    - Encryption
+    - Vulnerability management
+    
+  operational:
+    - Incident response
+    - Business continuity
+    - Change management
+```
+
+## Best Practices
+
+- Tier-based assessments
+- Regular reassessment
+- Contract security terms
+- Incident notification requirements
+- Exit strategy planning