Vendor risk management, explained

May 23, 2026

Your compliance posture includes the vendors that touch your data. Auditors know it, frameworks require it, and a spreadsheet of questionnaires is not a program.

Why it is required

PCI DSS, ISO 27001, SOC 2, and HIPAA all require you to manage the risk that third parties introduce — because a vendor with access to your data is part of your attack surface. The requirement is not "collect a questionnaire"; it is to assess, document, and monitor the risk each vendor represents.

What a real program tracks

• An inventory of vendors with what data each can access and how critical it is.
• A risk tier per vendor, so a payroll processor gets more scrutiny than a stock-photo site.
• Due-diligence artifacts — the vendor's own SOC 2 or ISO 27001, AOC, or questionnaire responses.
• Review cadence proportionate to tier, and a record of each review.

Keep it proportionate

The failure mode is treating every vendor identically and drowning in questionnaires nobody reads. Tier by data access and criticality, do deep diligence where it matters, and keep the register current. SentinelPanda's vendor register ties each vendor to its risk tier, attachments (AOCs, questionnaires), and review history in one place.