vendor-third-party-risk

Vendor Third-Party Risk

Overview

This skill implements third-party risk management (TPRM) for compliance programs—operating with the rigor of GRC platforms (Vanta, Drata, Secureframe) but without assuming a specific vendor tool. It complements hipaa-baa-vendor-assessment (legal BAA focus) with operational security assessment:

• Inherent/residual risk scoring
• SOC 2 Type II report review (bridge letters, subservice orgs)
• Security questionnaire mapping (SIG Lite, CAIQ, custom)
• Continuous monitoring of vendor status (breach news, certification expiry)
• Control inheritance decisions for SOC 2 carve-out reports

Applies to LLM providers, cloud hosts, MCP operators, observability SaaS, and identity providers.

When to Use

Use this skill when:

• Onboarding a new vendor processing customer data, ePHI, or CHD
• Annual vendor recertification in compliance calendar
• Reviewing vendor SOC 2 report for subservice organization reliance
• Completing security questionnaires sent to/from vendors
• Assessing LLM/AI vendor risk beyond BAA (model security, logging, subprocessors)
• Building vendor risk register for SOC 2 CC9.2 and HIPAA §164.308(b)
• Evaluating GRC automation tools themselves as vendors

Do not use this skill when:

• Drafting BAA legal clause analysis (use hipaa-baa-vendor-assessment)
• MCP OAuth configuration (use mcp-compliance-integration)
• Internal employee access reviews (use access-control-identity-audit)

Core Process

Execute steps in order.

Step 1: Vendor tiering

1. Classify vendors by inherent risk:

Tier	Criteria	Review depth	Examples
T1 Critical	ePHI/CHD processing, production access	Full assessment + SOC 2 + annual onsite/virtual	LLM with BAA, cloud prod, MCP host
T2 High	Confidential data, internal network access	SOC 2 + questionnaire	SIEM, IdP, ticketing
T3 Medium	Limited data, no prod access	Questionnaire + certification check	Marketing SaaS
T4 Low	No sensitive data	Lightweight attestation	Office supplies