Vendorapp › OpenVMO › Governance and ownership
Governance and ownership in OpenVMO.
Governance decides who is allowed to bring a vendor in, who answers for it once it is in, and who checks that the whole programme is working. At a startup it is a two-page policy and a few names, not a committee.
Open standard, CC BY 4.0 · Free, no sign-up · Works with a spreadsheet · Maps to SOC 2, ISO 27001, NIS2, DORA
Why it matters
What this domain is for.
Auditors and enterprise customers ask the same first question: who is responsible for this vendor? Without a named owner, renewals auto-renew, access outlives the contract, and nobody notices when a vendor changes what it does with your data.
Governance and ownership is one of the 11 domains of the OpenVMO framework, an open standard for running vendor management at a startup. Each practice below has a minimum maturity level: you only need the practices at or below the level you are aiming for.
Practices
The 6 GOV practices.
Approved policy
A vendor management policy exists, is approved by a founder or executive, and is reviewed at least once a year. Evidence: The signed policy with its approval date, and the date of the last review.
Owner for every vendor
Every vendor in the register has a named business owner who answers for the relationship. Evidence: The owner column of the register, with no blanks.
Programme lead
A vendor management lead is named, part-time is fine, with written responsibilities. Evidence: The lead’s name and responsibilities in the policy or a role description.
Third-party risk appetite
The company states what vendor risk it will and will not accept, for example "no Tier 1 vendor without SOC 2, ISO 27001 or compensating controls". Evidence: The appetite statement in the policy, approved by leadership.
Annual programme review
Once a year the programme is reviewed and the results are reported to the board or leadership team. Evidence: The review document or board paper, with its date and the actions agreed.
Defined roles
The roles of security, legal, finance and privacy in vendor decisions are written down. Evidence: A responsibility matrix (who is responsible, accountable, consulted and informed) in the policy.
A practice counts as in place only when a dated record shows it was performed. A tool that could perform it does not count on its own.
By stage
What good looks like at each level.
| Level | What good looks like |
|---|---|
| Level 1: Foundational | A two-page policy signed by a founder, and an owner against every vendor in the register. |
| Level 2: Managed | A named part-time lead, a stated risk appetite, and clear roles for security, legal, finance and privacy. |
| Level 3: Defined | An annual programme review that goes to the board or leadership, with actions tracked to completion. |
| Level 4: Optimised | The programme itself is independently assured, and governance reporting is part of the company’s risk framework. |
With a spreadsheet
Doing it without any special tool.
- Start from the OpenVMO policy template and fill in the names. Two pages is enough at Level 1.
- Add an "Owner" column to the register and refuse to leave it blank.
- Put the annual review in the calendar of whoever approved the policy.
Common mistakes
Where teams usually go wrong.
- Making the security or operations person the owner of every vendor. They coordinate; the team that uses the vendor owns it.
- Writing a 20-page policy nobody follows. Auditors test what you do against what you wrote.
- Approving the policy once and never reviewing it.
Crosswalk
How this maps to the frameworks you are audited against.
| Framework | Related requirements |
|---|---|
| SOC 2 (Trust Services Criteria) | CC9.2, CC1.3, CC3.1 |
| ISO/IEC 27001:2022 | A.5.19, A.5.2; clauses 5.2, 6.1, 9.3 |
| NIS2 and Implementing Regulation 2024/2690 | Art. 20; Art. 21(2)(d); CIR 2024/2690 Annex §5.1 |
| DORA | Art. 5; Art. 28(2); RTS 2024/1773 |
| NIST CSF 2.0 | GV.SC-01, GV.SC-02, GV.SC-03 |
The mapping is informative, not legal advice: it points to where each framework deals with the same topic. The full mapping for every practice is on the crosswalk page.
Templates
Templates for this domain.
- Vendor management policy (Markdown): A two-page policy with every section a startup needs. Fill in the names and sign it.
All OpenVMO templates are on the templates page.
Next domain: Vendor inventory.
Run OpenVMO with a spreadsheet, or with a tool.
Every practice can be met with the free templates. If you would rather not maintain the register by hand, Vendorapp implements most of OpenVMO and has a free plan.