GRC de Cibersegurança 12 itens
Third-Party & Vendor Risk Management Assessment
Este checklist está em inglês.
Assesses the third-party risk management lifecycle from onboarding due diligence through ongoing monitoring and offboarding.
SOC 2ISO 27001:2022NIST CSF 2.0
PDF ou Word gratuito · informe seu e-mail para baixar.
Program & Inventory
- Is a third-party risk management (TPRM) policy documented and approved? *
- Is a current inventory of vendors maintained with data access and criticality tiers? *
- Are fourth-party (subprocessor) dependencies identified for critical vendors? *
Onboarding Due Diligence
- Is a security assessment performed before onboarding based on risk tier? *
- Are attestations (SOC 2, ISO 27001) or questionnaires collected and reviewed? *
- Is the vendor's financial and operational stability considered for critical services? *
Contracts & Requirements
- Do contracts include information security, breach notification, and audit rights clauses? *
- Are data processing terms (DPA/BAA) in place where required? *
- Are right-to-audit and right-to-terminate provisions included? *
Ongoing Monitoring & Offboarding
- Are vendors reassessed periodically based on their risk tier? *
- Are vendor security incidents tracked and evaluated for impact? *
- Is access revoked and data returned or destroyed at contract termination? *
Baixe o checklist Third-Party & Vendor Risk Management Assessment completo
Receba gratuitamente em PDF limpo e pronto para impressão ou em documento Word editável.