DevOps-Security-Agent-Skills/compliance/governance/vendor-management/SKILL.md

name, description, license, metadata

name	description	license	metadata
vendor-management	Implement vendor risk management programs. Assess third-party security and maintain vendor inventory. Use when managing supplier security.	MIT	author version devops-skills 1.0

Vendor Management

Manage third-party vendor security risks.

Vendor Assessment

assessment_process:
  1_identify:
    - Catalog all vendors
    - Classify by risk tier
    
  2_assess:
    - Security questionnaire
    - SOC 2 review
    - Penetration test results
    
  3_contract:
    - Security requirements
    - Data processing agreement
    - SLAs
    
  4_monitor:
    - Continuous monitoring
    - Annual reassessment
    - Incident notification

Risk Tiers

Tier	Criteria	Assessment
Critical	Access to sensitive data	Full assessment, annual
High	Significant data access	Questionnaire + SOC 2
Medium	Limited data access	Security questionnaire
Low	No data access	Basic due diligence

Security Questionnaire

categories:
  governance:
    - Security policies
    - Risk management
    - Compliance certifications
    
  technical:
    - Access controls
    - Encryption
    - Vulnerability management
    
  operational:
    - Incident response
    - Business continuity
    - Change management

Best Practices

• Tier-based assessments
• Regular reassessment
• Contract security terms
• Incident notification requirements
• Exit strategy planning