# [Company name] vendor management policy

Based on the OpenVMO v1.0 policy template · Licence: CC BY 4.0 · https://vendorapp.co/openvmo/governance/

| | |
| --- | --- |
| Version | [1.0] |
| Approved by | [Founder or executive name and role] |
| Approval date | [YYYY-MM-DD] |
| Next review | [Approval date + 12 months] |
| Vendor management lead | [Name] (Level 2 and above, GOV-3) |

## 1. Purpose and scope

This policy sets out how [Company] chooses, checks, contracts, monitors and exits the vendors it depends on. It applies to **every vendor that receives our money, our data, or access to our systems**, including free tools and services paid by card.

## 2. Roles

- **Business owner.** Every vendor has one named owner: the person whose team uses it. The owner requests the vendor, keeps its register entry accurate, and leads its reviews and offboarding.
- **Vendor management lead.** Keeps the register, runs this policy, and reports on it. *(At Level 1, a founder may hold this role.)*
- **Security and privacy.** Approve Tier 1 and Tier 2 vendors and review their assurance.
- **Finance.** Approves vendors above [spend threshold] a year and flags new recurring charges without a register entry.
- **Legal.** Reviews Tier 1 and Tier 2 contracts against the clause checklist.

## 3. The register

All vendors are recorded in one register at [location], with the OpenVMO minimum fields. Vendors are never deleted; when a relationship ends, the entry is marked offboarded with the date and reason.

## 4. Tiering

Every vendor is tiered with the OpenVMO tiering rubric before it receives data or access, and re-tiered when its data, access or scope changes.

## 5. Minimum checks by tier

- **All vendors:** confirm the legal entity and domain, and run a sanctions check where required.
- **Tier 2:** check the vendor's trust centre or certificates.
- **Tier 1:** review an assurance report (SOC 2 Type II, an ISO 27001 certificate verified with the issuer) or a standard questionnaire.
- **Any vendor processing personal data:** a data processing agreement, a lawful transfer mechanism and a subprocessor list.

No production data or system access is given until the checks for the vendor's tier are complete.

## 6. Contract minimums

Tier 1 and Tier 2 contracts are checked against the OpenVMO contract clause checklist. Missing clauses are recorded as accepted risks (section 9). Renewal and notice dates are tracked for every contract, with a reminder at least one notice period ahead.

## 7. Monitoring

Vendors are reviewed at least: Tier 1 yearly and after any significant event (a breach, acquisition, sanctions listing or change of scope), Tier 2 every two years, Tier 3 at renewal. Expiring certificates, reports and DPAs are chased before they lapse.

## 8. Offboarding

When a relationship ends, the owner completes the OpenVMO offboarding checklist: access revoked, data return or deletion confirmed in writing, final invoices settled, assets returned and the register updated.

## 9. Exceptions and risk acceptance

Any exception to this policy is recorded in the register with the reason, an owner and an expiry date of no more than 12 months. Exceptions for Tier 1 vendors are approved by [role].

## 10. Review

This policy is reviewed at least once a year by [approver]. Changes are recorded below.

| Date | Change | Approved by |
| --- | --- | --- |
| [YYYY-MM-DD] | First version | [Name] |