<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Vendor Compliance Management — API Reference

## Vendor Risk Assessment

```bash
# Register and score vendor
node scripts/agent.js --action register --vendor "CloudCo" \
  --data-types "PII,Financial" --criticality high

# Initiate SIG assessment
node scripts/agent.js --action assess --vendor "CloudCo" --method sig

# Generate compliance report
node scripts/agent.js --action report --input vendor-assess.json
```

## Security Rating Checks

```bash
# Check domain security headers
curl -sI https://vendor.example.com | grep -iE "^(strict|x-frame|x-content|content-security)"

# Check TLS configuration
openssl s_client -connect vendor.example.com:443 2>/dev/null | \
  openssl x509 -noout -subject -dates -issuer

# DNS security records
dig +short vendor.example.com TXT | grep -E "v=spf|DMARC"
dig +short _dmarc.vendor.example.com TXT

# Check for known breaches (haveibeenpwned API)
curl -s "https://haveibeenpwned.com/api/v3/breaches?domain=vendor.example.com" \
  -H "hibp-api-key: <KEY>" | jq '.[].Name'
```

## SOC 2 Report Review Checklist

```bash
# Key areas to verify in SOC 2 Type II report
cat << 'EOF'
1. Report period covers at least 6 months
2. No qualified/adverse opinion
3. Exceptions noted and remediated
4. Trust criteria coverage matches your requirements
5. Subservice organizations identified (carve-out vs inclusive)
6. Complementary user entity controls documented
7. Penetration testing frequency
8. Incident response testing evidence
EOF
```

## SIG Lite vs Full

| Aspect | SIG Lite | SIG Full |
|--------|----------|----------|
| Questions | ~100 | ~800+ |
| Use case | Low/Medium risk vendors | High/Critical risk vendors |
| Domains | 18 (subset) | 18 (comprehensive) |
| Completion time | 2–4 hours | 2–4 weeks |
| Annual update | Required | Required |

## Contractual Security Requirements

```bash
# Key clauses for vendor contracts
cat << 'EOF'
- Data processing agreement (GDPR Art. 28)
- Security requirements addendum
- Right-to-audit clause
- Breach notification: 24-48 hours
- Data return/destruction on termination
- Subprocessor approval requirements
- Insurance minimums (cyber liability)
- SLA with uptime guarantees
- Compliance certification maintenance
EOF
```
