<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-security-vendor-management
description: >-
  Evaluate, select, manage, and monitor security vendors including RFP
  processes, contract negotiation, SLA enforcement, third-party risk
  assessment, and vendor consolidation strategies.
domain: cybersecurity
subdomain: security-leadership
tags:
  - vendor-management
  - third-party-risk
  - rfp
  - contract-negotiation
  - sla-management
  - vendor-assessment
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1199"]
---

# Building Security Vendor Management

## Overview

Security vendor management ensures third-party tools and services
deliver expected value while maintaining acceptable risk. Covers
evaluation, selection, contract management, and performance monitoring.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Procurement process | Purchasing and legal review workflow |
| Risk framework | Third-party risk assessment methodology |
| Budget authority | Approved spend for security tools |

## Key Concepts

### Vendor Risk Tiering

```python
vendor_tiers = {
    "critical": {"criteria": "Sensitive data, production access, single point of failure",
                 "assessment": "annual_full_audit", "review": "quarterly"},
    "high": {"criteria": "Internal system access, confidential data",
             "assessment": "annual_questionnaire_plus_evidence", "review": "semi_annual"},
    "medium": {"criteria": "Limited data access, replaceable",
               "assessment": "annual_questionnaire", "review": "annual"},
}
```

## Workflow

1. **Define requirements** — Must-have and nice-to-have capabilities
2. **Tier the engagement** — Classify by data access and criticality
3. **Issue RFP** — Weighted scoring evaluation criteria
4. **Assess risk** — Security questionnaire, SOC 2, pen test review
5. **Negotiate contract** — SLAs, breach notification, exit clauses
6. **Onboard vendor** — Integration, access provisioning, monitoring
7. **Monitor performance** — SLA tracking, incident review, reassessment

## Verification

| Check | Method |
|---|---|
| Workflow completed | All steps executed and documented |
| Output validated | Results match expected format and content |
| Quality assured | Peer review or automated validation passed |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
