<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Performing Vendor Security Assessment — API Reference

## SIG Lite Domains

| Domain | Category | Key Questions |
|--------|----------|---------------|
| A | Enterprise Risk Management | Security program, CISO, risk assessments |
| B | Security Policy | Policy documentation, annual review |
| C | Organizational Security | Background checks, security training |
| D | Asset & Info Management | Data classification, encryption |
| E | Access Control | MFA, access reviews, least privilege |
| F | Incident Management | IR plan, notification timeline, testing |
| G | Business Continuity | DR plan, backup testing |
| H | Compliance | SOC 2, penetration testing |

## SOC 2 Report Review

```
Review checklist:
1. Report type: Type I (design only) vs Type II (design + operating effectiveness)
2. Audit period: should cover recent 12 months
3. Trust Service Criteria covered: Security (required), plus relevant criteria
4. Qualified opinions: any exceptions noted by auditor?
5. CUECs: what controls are YOUR responsibility?
6. Subservice organizations: carved-out vs inclusive method?
7. Bridge letter: covers gap between report period and current date?
```

## SecurityScorecard API

```bash
# Get vendor score
curl -s -H "Authorization: Token $API_TOKEN" \
  "https://api.securityscorecard.io/companies/example.com" | jq '.overall_score'

# Get factor scores
curl -s -H "Authorization: Token $API_TOKEN" \
  "https://api.securityscorecard.io/companies/example.com/factors" | \
  jq '.entries[] | {name, score, grade}'

# Get historical scores
curl -s -H "Authorization: Token $API_TOKEN" \
  "https://api.securityscorecard.io/companies/example.com/history/overall_score"
```

## BitSight API

```bash
# Get company rating
curl -s -H "X-BITSIGHT-TOKEN: $TOKEN" \
  "https://api.bitsighttech.com/ratings/v1/companies/$GUID" | jq '.rating'

# Get risk vectors
curl -s -H "X-BITSIGHT-TOKEN: $TOKEN" \
  "https://api.bitsighttech.com/ratings/v1/companies/$GUID/risk-vectors"
```

## Vendor Risk Tier Matrix

| Tier | Data Access | Assessment | Frequency | Approval |
|------|-------------|------------|-----------|----------|
| 1 - Critical | PII/PHI/Financial | Full SIG + SOC 2 + Pentest | Annual | CISO |
| 2 - High | PII/Internal | SIG Lite + SOC 2 | Annual | Security Lead |
| 3 - Medium | Internal/Metadata | CAIQ/Custom | Biennial | Security Team |
| 4 - Low | Public/None | ToS Review | At onboarding | Manager |

## Contract Security Clauses

| Clause | Requirement | Standard |
|--------|-------------|----------|
| DPA | Required for PII | GDPR Art. 28 |
| Incident notification | ≤72 hours | GDPR Art. 33 |
| Right to audit | Annual | ISO 27001 A.15 |
| Subprocessor notice | 30 days advance | GDPR Art. 28(2) |
| Data deletion | 30 days post-termination | GDPR Art. 28(3)(g) |
| Cyber insurance | ≥$5M | Industry standard |
