<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-vendor-compliance-management
description: >-
  Manage third-party vendor compliance through risk assessment questionnaires,
  SIG/CAIQ evaluation, continuous monitoring of vendor security posture, and
  contractual compliance tracking. Automate vendor risk scoring and
  remediation workflows across the vendor lifecycle.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - vendor-management
  - third-party-risk
  - tprm
  - sig
  - caiq
  - supply-chain
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Vendor Compliance Management

## Overview

Third-party risk management (TPRM) ensures vendors handling sensitive data
maintain adequate security controls. This skill automates vendor risk
assessment using SIG (Standardized Information Gathering) and CSA CAIQ
(Consensus Assessments Initiative Questionnaire), continuous posture
monitoring, contractual compliance tracking, and vendor risk scoring
throughout the engagement lifecycle.

Mode: `[MODE: ARCHITECT]` — Vendor risk governance and compliance management.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | For agent tooling |
| jq | `apt install jq` |
| curl | For external rating API checks |

## Key Concepts

### Vendor Risk Lifecycle

```
Vendor Lifecycle:
├── 1. Identification & Classification
│   ├── Vendor inventory
│   ├── Data classification (what data shared)
│   ├── Criticality rating (business impact)
│   └── Inherent risk tier (Critical/High/Medium/Low)
├── 2. Due Diligence & Assessment
│   ├── SIG questionnaire (Shared Assessments)
│   ├── CSA CAIQ (cloud vendors)
│   ├── SOC 2 Type II report review
│   ├── Penetration test results review
│   └── Security rating service score
├── 3. Contractual Controls
│   ├── Security requirements addendum
│   ├── Data processing agreement (GDPR Art. 28)
│   ├── Right-to-audit clauses
│   ├── Breach notification requirements
│   └── SLA and uptime guarantees
├── 4. Ongoing Monitoring
│   ├── Annual reassessment schedule
│   ├── Security rating monitoring
│   ├── Incident notification tracking
│   └── Compliance certificate renewal
└── 5. Offboarding
    ├── Data return/destruction verification
    ├── Access revocation confirmation
    └── Final compliance attestation
```

### Vendor Risk Scoring

| Risk Factor | Weight | Low (1) | Medium (2) | High (3) | Critical (4) |
|---|---|---|---|---|---|
| Data sensitivity | 30% | Public | Internal | Confidential | PII/PHI/CHD |
| System access | 25% | None | Read-only | Read-write | Admin/root |
| Business criticality | 20% | Nice-to-have | Important | Critical | Essential |
| Regulatory scope | 15% | None | SOC 2 | HIPAA/PCI | Multi-framework |
| Replaceability | 10% | Easy | Moderate | Difficult | Sole source |

### SIG Assessment Domains

```yaml
sig_domains:
  - domain: "A. Risk Management"
    questions: 15
    focus: "Governance, risk appetite, risk treatment"
  - domain: "B. Security Policy"
    questions: 12
    focus: "Policy framework, review cadence"
  - domain: "C. Organizational Security"
    questions: 18
    focus: "Roles, awareness, training"
  - domain: "D. Asset Management"
    questions: 10
    focus: "Inventory, classification, handling"
  - domain: "E. Access Control"
    questions: 22
    focus: "Authentication, authorization, MFA"
  - domain: "F. Cryptography"
    questions: 8
    focus: "Encryption at rest and in transit"
  - domain: "G. Physical Security"
    questions: 14
    focus: "Facility, environmental controls"
  - domain: "H. Operations Security"
    questions: 20
    focus: "Change management, capacity, logging"
  - domain: "I. Network Security"
    questions: 16
    focus: "Segmentation, monitoring, firewalls"
  - domain: "J. Incident Management"
    questions: 12
    focus: "Detection, response, notification"
  - domain: "K. Business Continuity"
    questions: 10
    focus: "BCP, DRP, RTO/RPO"
  - domain: "L. Compliance"
    questions: 8
    focus: "Regulatory, contractual, audit"
```

## Workflow

### Step 1: Register and Classify Vendor

```bash
node scripts/agent.js --action register --vendor "CloudCo Inc" \
  --data-types "PII,Financial" --criticality high \
  --output /tmp/vendor-register.json
```

### Step 2: Assess Vendor Risk

```bash
node scripts/agent.js --action assess --vendor "CloudCo Inc" \
  --method sig --output /tmp/vendor-assess.json
```

### Step 3: Generate Compliance Report

```bash
node scripts/agent.js --action report --input /tmp/vendor-assess.json \
  --output /tmp/vendor-report.json
```

## Verification

- [ ] Vendor inventory complete with data classification
- [ ] Risk tier assigned based on scoring methodology
- [ ] SIG/CAIQ questionnaire completed and reviewed
- [ ] SOC 2 Type II report obtained and reviewed
- [ ] Contractual security requirements documented
- [ ] Annual reassessment scheduled and tracked
- [ ] Breach notification requirements contractually defined

## References

- [Shared Assessments SIG](https://sharedassessments.org/)
- [CSA CAIQ](https://cloudsecurityalliance.org/star/registry/)
- [NIST SP 800-161 Supply Chain Risk](https://csrc.nist.gov/publications/detail/sp/800-161/rev-1/final)
- [ISO 27036 Supplier Relationships](https://www.iso.org/standard/59689.html)
