Vendorapp › OpenVMO › Templates
OpenVMO templates. Everything you need, in files you already know how to use.
Ten free files that implement OpenVMO without any special tool: a vendor register, a register schema for tools, a one-page tiering rubric, a two-page policy, an intake form, a due-diligence matrix, a contract clause checklist, an offboarding checklist, a measures sheet and the crosswalk. Download them directly, with no sign-up. The CSV files open in Excel, Google Sheets or Numbers; the Markdown files open in any text editor or paste into a document.
Open standard, CC BY 4.0 · Free, no sign-up · Works with a spreadsheet · Maps to SOC 2, ISO 27001, NIS2, DORA
Downloads
10 templates.
| Template | What it is | Licence |
|---|---|---|
| Vendor register (CSV) | The register with every OpenVMO minimum field as a column, plus two example rows. Open it in any spreadsheet. | CC0 1.0 |
| Register schema (JSON Schema) | The same register as a JSON Schema, for tools that want to import or export OpenVMO registers. | CC0 1.0 |
| Risk-tiering rubric (Markdown) | Five questions, one page. Take the highest answer and that is the vendor’s tier. | CC BY 4.0 |
| Vendor management policy (Markdown) | A two-page policy with every section a startup needs. Fill in the names and sign it. | CC BY 4.0 |
| Intake form (Markdown) | Eight fields that capture what you need to tier a new vendor before anyone signs up. | CC BY 4.0 |
| Due-diligence matrix (Markdown) | What evidence to accept for each tier, in order of preference, so you only send questionnaires when you have to. | CC BY 4.0 |
| Contract clause checklist (Markdown) | The clause set for Tier 1 and 2 contracts, with a column for what the contract actually says. | CC BY 4.0 |
| Offboarding checklist (Markdown) | Every step to close a vendor relationship cleanly, with space for the evidence. | CC BY 4.0 |
| Measures sheet (CSV) | The seven OpenVMO programme measures, with how to calculate each from the register. | CC0 1.0 |
| Crosswalk (CSV) | Every OpenVMO practice mapped to SOC 2, ISO 27001:2022, NIS2, DORA and NIST CSF 2.0. | CC0 1.0 |
Where to start
Three files get you to Level 1.
- The vendor registerFill it from your card and bank statements and your single sign-on app list. One row per vendor, an owner in every row.
- The tiering rubricAnswer five questions per vendor and take the highest tier. It takes a minute per vendor once you know the questions.
- The policyFill in the names, delete what does not apply, and have a founder sign it.
Then add the intake form and the offboarding checklist as you need them. The maturity page lists exactly which practices each level requires, and each domain page, such as vendor inventory, explains how to meet its practices with these files.
Licence
Use them however you like.
The document templates are CC BY 4.0: adapt them, put your logo on them, use them with clients, as long as you credit OpenVMO. The register, schema, measures sheet and crosswalk are CC0 1.0, with no conditions at all, so tools and consultants can build on them freely.
Run OpenVMO with a spreadsheet, or with a tool.
Every practice can be met with the free templates. If you would rather not maintain the register by hand, Vendorapp implements most of OpenVMO and has a free plan.