<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-vendor-security-assessment
description: >-
  Perform vendor and third-party security assessments using SIG Lite, CAIQ,
  SOC 2 review, and automated scoring. Evaluate vendor security posture,
  data handling practices, and contractual security requirements.
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - vendor-risk
  - third-party-risk
  - sig-lite
  - caiq
  - soc2
  - due-diligence
  - tprm
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1199"]
---

# Performing Vendor Security Assessment

## Overview

Third-party vendor risk is a leading cause of data breaches. Vendor security
assessments evaluate the security posture of suppliers handling sensitive data or
providing critical services. This skill covers conducting assessments using
industry frameworks (SIG Lite, CAIQ), reviewing SOC 2 reports, automating
security scoring, and managing ongoing vendor risk monitoring.

Mode: `[MODE: ARCHITECT]` — Design vendor assessment program; `[MODE: BLUE]` — Execute assessments.

## Prerequisites

| Requirement | Details |
|---|---|
| Security questionnaire templates (SIG Lite, CAIQ) | Required |
| SOC 2 report analysis capability | Required |
| SecurityScorecard or BitSight access (optional) | Required |
| Python 3.10+ for automated assessment scoring | Required |

## Key Concepts

### Assessment Framework

```
Vendor risk tiers:
├── Tier 1 (Critical): Access to sensitive data, critical infrastructure
│   Assessment: Full SIG, SOC 2 Type II, pen test report, on-site audit
│   Frequency: Annual + continuous monitoring
├── Tier 2 (High): Access to internal systems, PII processing
│   Assessment: SIG Lite, SOC 2 Type II, vulnerability scan results
│   Frequency: Annual
├── Tier 3 (Medium): Limited data access, non-critical services
│   Assessment: CAIQ or custom questionnaire, self-attestation
│   Frequency: Biennial
└── Tier 4 (Low): No data access, commodity services
    Assessment: Terms of service review, public security page
    Frequency: At onboarding
```

### SOC 2 Report Review

```
SOC 2 Review Checklist:
├── Report type: Type I (point-in-time) vs Type II (over period)
├── Audit period: covers recent 12 months?
├── Trust Service Criteria: Security, Availability, Confidentiality, Processing Integrity, Privacy
├── Exceptions noted: any qualified opinions?
├── Complementary User Entity Controls (CUECs): responsibilities on your side
├── Subservice organizations: who else is in the chain?
├── Management assertions: any disclaimers?
└── Auditor: reputable firm? (Big 4, reputable regional)
```

### Contractual Security Requirements

```
Essential contract clauses:
├── Data Processing Agreement (DPA) — GDPR Art. 28
├── Incident notification: within 72 hours (GDPR) or 24 hours (preferred)
├── Right to audit: annual audit rights
├── Subprocessor notification: 30 days advance notice
├── Data deletion: upon termination, within 30 days
├── Insurance: cyber liability minimum $5M
├── SLA: uptime, RTO, RPO commitments
└── Exit strategy: data portability format, transition period
```

## Workflow

### Step 1: Classify Vendor Risk Tier

```bash
node scripts/agent.js --action classify --vendor "Acme Corp" --data-access pii --criticality high --output /tmp/tier.json
```

### Step 2: Generate Assessment Questionnaire

```bash
node scripts/agent.js --action questionnaire --tier 1 --framework sig-lite --output /tmp/questionnaire.json
```

### Step 3: Score Assessment Responses

```bash
node scripts/agent.js --action score --responses /tmp/responses.json --output /tmp/score.json
```

## Detection

```yaml
title: Vendor Security Assessment Detection
id: c00d37e9-4a39-456b-8396-8b232754ec88
status: experimental
description: Detects suspicious activity related to performing vendor security assessment techniques in supply chain security context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*performing*vendor*"
  condition: selection
level: medium
tags:
  - attack.t1199
  - attack.initial_access
falsepositives:
  - Package manager performing routine dependency resolution
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Vendor Security Assessment Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1199 |

## Verification

- [ ] All Tier 1 vendors have current SOC 2 Type II reports
- [ ] Vendor risk tiers assigned based on data access and criticality
- [ ] DPA executed for all vendors processing personal data
- [ ] Incident notification SLA defined contractually
- [ ] Annual reassessment scheduled for Tier 1-2 vendors
- [ ] Continuous monitoring active (SecurityScorecard/BitSight)

## References

- [SIG Questionnaire (Shared Assessments)](https://sharedassessments.org/sig/)
- [CSA CAIQ](https://cloudsecurityalliance.org/star/registry)
- [NIST SP 800-161 — Supply Chain Risk Management](https://csrc.nist.gov/publications/detail/sp/800-161/rev-1/final)
- [ISO 27001:2022 Annex A.15 — Supplier Relationships](https://www.iso.org/standard/27001)
