What is vendor management? A practical guide.

Every company runs on vendors: cloud hosting, payments, payroll, CRM, analytics, contractors. Vendor management is the discipline of knowing who those vendors are, what each one can access, what could go wrong with each, what your contract says, and what you are doing to keep that risk in check, from the day you choose a vendor to the day you stop using it.

Done well, it produces two things: better commercial outcomes (no surprise renewals, no paying twice for the same tool) and evidence. Evidence is what an auditor, a bank, an enterprise customer or a regulator asks for when they want to know whether your vendors are under control.

A few years ago vendor management was a procurement concern at large companies. Today it reaches startups early, because most security and compliance frameworks treat your vendors as part of your own risk. SOC 2, ISO 27001, NIS2, DORA and similar frameworks all contain a supplier or third-party control, and enterprise security questionnaires almost always include a section on how you manage your own vendors.

For framework-specific detail, see our guides to vendor management for SOC 2, ISO 27001 supplier management and the NIS2 supply chain security guide.

Whatever tool you use, vendor management follows the same lifecycle. Most gaps that auditors find sit at the two ends: vendors that were never assessed when they were onboarded, and vendors that were never properly offboarded when the relationship ended.

1. 1

   Select and do due diligence

   Before you commit, check who the vendor is: that the company is real, where it is based, whether it appears on sanctions lists, what security certifications it holds and what data it would touch. The depth should match the risk: a payroll provider deserves more scrutiny than a design tool.

2. 2

   Onboard into a single register

   Add the vendor to one register that everyone uses, with an owner, what it is used for, what systems and data it can access, and key contacts. If a vendor is not in the register, it does not exist as far as your programme is concerned, and that is how the long tail gets missed.

3. 3

   Assess and classify the risk

   Give each vendor a risk level based on access and impact: for example Critical, High, Medium or Low. Record the inherent risk (before controls) and the residual risk (after the contract, certifications and your own controls). The classification decides how often you review each vendor.

4. 4

   Contract with security in mind

   Make sure the agreement covers what matters: data protection (a DPA where personal data is involved), breach notification, security obligations, your right to evidence or audit, and exit terms. Track the renewal and notice dates so the contract does not renew itself without a decision.

5. 5

   Monitor continuously

   Risk changes after onboarding. Vendors suffer breaches, change ownership, come under sanctions or let certifications lapse. Ongoing monitoring means a scheduled review for every vendor, more often for critical ones, plus alerts for material changes between reviews.

6. 6

   Offboard cleanly

   When a relationship ends, revoke access, retrieve or confirm deletion of your data, close the contract and mark the vendor inactive while keeping its history. Auditors increasingly ask to see this record.

Two stages have their own guides: vendor contract management and vendor offboarding.

These terms overlap and are often used interchangeably. The distinction matters mostly when you are choosing software, because tools built for one rarely do the others well.

In a startup or growing company these usually land on the same one or two people, which is why a single system that covers the register, risk and contracts tends to work better than three separate tools. For the wider view, read our guides to third-party risk management and fourth-party risk(your vendors' vendors).

You do not need a dedicated team. You need a short list of things to exist, be kept current and leave a dated trail:

• A complete vendor register, including the long tail of small tools with access to data
• An owner for every vendor, and a named person accountable for the programme
• A risk classification for every vendor, with the reasoning recorded
• Due-diligence evidence for critical vendors: certifications, sanctions checks, security posture
• Contracts and DPAs stored against each vendor, with renewal and notice dates tracked
• A review schedule by risk level, and evidence that reviews actually happened
• Alerts for breaches, sanctions changes and expiring contracts between reviews
• An offboarding record for every vendor you stopped using
• A written policy that matches what you actually do

• The register only covers the obvious vendors. Cloud and payments are listed; the HR tool, the analytics script and the contractor with API keys are not. Those are exactly the gaps auditors look for.
• Assessments happen once. A vendor assessed at onboarding three years ago and never again is not being managed. Reviews need a schedule and a record.
• Policy and practice disagree. A policy that promises annual reviews, with no evidence of any, is worse than a modest policy you can prove you follow.
• Contracts live in inboxes. Nobody knows when the notice period opens, so tools auto-renew and security clauses are never checked.
• Nobody owns it. Vendor management sits between finance, security, legal and operations, so it drifts until an audit or a customer questionnaire forces a scramble.

1. 1

   Day 1: find every vendor

   Export the last twelve months of card and bank payments, list your SSO-connected apps, and ask each team lead what they use. Combine into one list.

2. 2

   Day 2: put them in one register

   One place, one owner per vendor, what each is used for, and what data and systems it can access.

3. 3

   Day 3: classify by risk

   Mark the vendors that touch customer data, production systems or money as critical. Start your checks with those.

4. 4

   Day 4: check the critical ones

   Sanctions screening, security certifications, breach history and a signed DPA where personal data is involved.

5. 5

   Day 5: contracts and a schedule

   Attach contracts, note renewal and notice dates, set review frequencies by risk level, and write a one-page policy that describes what you just did.

A spreadsheet can carry you through the first week. It starts to break when you need ongoing monitoring, a dated audit trail and contract alerts, which is the point where most teams move to dedicated software. Our guide to choosing vendor management software explains what to look for.

Vendorapp is a vendor management and third-party risk platform built for startups and growing companies that need audit-ready evidence without a GRC team. It covers each stage above:

• Smart Lookup: add a vendor by name or website from 22M+ indexed companies
• Vendorapp Intelligence risk ratings, plus your own inherent and residual scores
• Sanctions and watchlist screening, including OFAC, UN, EU, UK OFSI and DFAT lists
• Contract tracking with key terms extracted and renewal alerts
• Breach and incident monitoring, with alerts between reviews
• A full audit trail, with inactive vendors kept in history for your offboarding record
• A free-forever plan for up to 15 active vendors; paid plans from $149 a month