vendor-management – skill Bảo mật cho agent AI

Vendor Management

Implement a vendor risk management program covering vendor assessment questionnaires, risk scoring, contract tracking, SLA monitoring, and ongoing oversight for compliance with SOC 2, ISO 27001, and regulatory frameworks.

Vendor Risk Tiering

Illustrative policy defaults, not regulatory requirements or automatic vendor classifications.

Tier the actual data flows/access/criticality: HR and expense systems can hold highly

sensitive data and must not be assigned Medium just by product category. Deadlines,

DPAs and BAAs depend on applicable law/role/contract; 72 hours is not a universal

vendor notice rule. Have qualified owners determine obligations. Request minimal

redacted evidence through approved channels; restrict report/employee/contact data.

SOC 2 is an attestation report, not a certification; review scope, period, exceptions,

subservice organizations and complementary controls rather than counting badges.

vendor_risk_tiers:
  critical:
    criteria:
      - Processes or stores sensitive/regulated data (PII, PHI, PCI)
      - Single point of failure (no alternative vendor)
      - Has privileged access to production systems
      - Handles authentication or security-critical functions
    assessment_requirements:
      - Full security questionnaire (SIG or custom)
      - SOC 2 Type II report review (or equivalent)
      - Penetration test results review
      - On-site or virtual security assessment (optional)
      - Business continuity and DR plan review
    review_frequency: Annual
    contract_requirements:
      - Data processing agreement (DPA)
      - Business associate agreement (BAA) if PHI
      - Security SLA with breach notification timeline
      - Right to audit clause
      - Cyber insurance requirements
    examples:
      - Cloud infrastructure providers (AWS, Azure, GCP)
      - Identity providers (Okta, Azure AD)
      - Payment processors (Stripe, Adyen)
      - Primary database or CRM SaaS

  high:
    criteria:
      - Accesses significant company data (internal or confidential)
      - Integrates with production systems via API
      - Processes customer-facing transactions
      - Substitution would cause significant business disruption
    assessment_requirements:
      - Security questionnaire
      - SOC 2 report review (Type I or Type II)
      - Compliance certifications verified
    review_frequency: Annual
    contract_requirements:
      - Data processing agreement
      - Security requirements appendix
      - Incident notification clause (72 hours)
    examples:
      - Email/marketing platforms (SendGrid, HubSpot)
      - Monitoring and logging SaaS (Datadog, Splunk)
      - CI/CD platforms (GitHub, GitLab)
      - Customer support platforms

  medium:
    criteria:
      - Limited data access (internal data only)
      - Non-production system integration
      - Some business impact if unavailable
    assessment_requirements:
      - Abbreviated security questionnaire
      - Compliance certification verification
    review_frequency: Every 2 years
    contract_requirements:
      - Standard vendor terms with security clause
      - NDA
    examples:
      - Project management tools
      - HR platforms
      - Travel and expense systems

  low:
    criteria:
      - No access to company data
      - No system integration
      - Easily replaceable
    assessment_requirements:
      - Basic due diligence (public info review)
      - Confirm no data sharing
    review_frequency: Every 3 years or on renewal
    contract_requirements:
      - Standard terms
    examples:
      - Office supply vendors
      - Facilities services
      - General consulting (no data access)

Vendor Assessment Questionnaire

security_questionnaire:
  section_1_governance:
    questions:
      - "Do you have a documented information security policy?"
      - "Is there a designated CISO or security lead?"
      - "Do you conduct annual security risk assessments?"
      - "Do you have a security awareness training program?"
      - "What compliance certifications do you hold? (SOC 2, ISO 27001, etc.)"
      - "When was your last external security audit?"
      - "Do you carry cyber liability insurance? What coverage limits?"
    evidence_requested:
      - Information security policy (or summary)
      - SOC 2 Type II report (or bridge letter)
      - ISO 27001 certificate
      - Cyber insurance certificate

  section_2_access_control:
    questions:
      - "How do you manage user access to systems containing our data?"
      - "Is multi-factor authentication enforced for all personnel?"
      - "How frequently do you conduct access reviews?"
      - "What is your process for revoking access upon employee termination?"
      - "Do you support SSO/SAML integration for customer access?"
      - "How do you manage privileged access?"
    evidence_requested:
      - Access management policy
      - MFA configuration documentation
      - Access review records (sample)

  section_3_data_protection:
    questions:
      - "How is our data encrypted at rest?"
      - "How is our data encrypted in transit?"
      - "In which geographic regions is our data stored?"
      - "Do you use sub-processors? If so, provide a list."
      - "What is your data retention policy?"
      - "How is our data isolated from other customers? (multi-tenancy model)"
      - "Can you provide data export in standard formats upon request?"
      - "What is your data destruction process at contract end?"
    evidence_requested:
      - Encryption standards documentation
      - Sub-processor list
      - Data flow diagram showing customer data handling

  section_4_vulnerability_management:
    questions:
      - "How frequently do you perform vulnerability scans?"
      - "How frequently do you conduct penetration tests?"
      - "What is your patch management SLA for critical vulnerabilities?"
      - "Do you have a responsible disclosure or bug bounty program?"
      - "How do you manage vulnerabilities in third-party dependencies?"
    evidence_requested:
      - Penetration test executive summary (last 12 months)
      - Vulnerability management policy
      - Patch management SLA documentation

  section_5_incident_response:
    questions:
      - "Do you have a documented incident response plan?"
      - "What is your breach notification timeline?"
      - "Have you experienced a data breach in the last 3 years?"
      - "How would you notify us in the event of a security incident?"
      - "Do you conduct incident response tabletop exercises?"
    evidence_requested:
      - Incident response plan summary
      - Breach notification procedure

  section_6_business_continuity:
    questions:
      - "Do you have a business continuity plan?"
      - "Do you have a disaster recovery plan?"
      - "What are your RTO and RPO targets?"
      - "How frequently do you test your DR plan?"
      - "What is your uptime SLA?"
      - "Do you have geographic redundancy?"
    evidence_requested:
      - BCP/DR plan summary
      - Uptime SLA documentation
      - Most recent DR test results

  section_7_compliance:
    questions:
      - "Do you process data subject to GDPR, HIPAA, or PCI DSS?"
      - "How do you support our compliance obligations?"
      - "Do you have a Data Processing Agreement (DPA) template?"
      - "How do you handle data subject access requests (DSARs)?"
      - "Are you FedRAMP authorized? If so, at what impact level?"
    evidence_requested:
      - DPA template
      - Compliance certification documentation

Risk Scoring Model

risk_scoring:
  dimensions:
    data_sensitivity:
      weight: 30
      scores:
        1: "No access to company or customer data"
        2: "Access to public or non-sensitive internal data"
        3: "Access to internal confidential data"
        4: "Access to PII or customer financial data"
        5: "Access to regulated data (PHI, PCI, classified)"

    system_access:
      weight: 25
      scores:
        1: "No system access"
        2: "Read-only access to non-production"
        3: "Read/write access to non-production or read-only production"
        4: "Read/write access to production systems"
        5: "Privileged/admin access to production or security systems"

    business_criticality:
      weight: 20
      scores:
        1: "No operational dependency"
        2: "Minor convenience; easily replaced"
        3: "Moderate dependency; replacement in weeks"
        4: "Significant dependency; replacement in months"
        5: "Critical dependency; no viable alternative"

    security_posture:
      weight: 15
      scores:
        5: "No certifications, no formal security program"
        4: "Some security controls but no external validation"
        3: "SOC 2 Type I or equivalent"
        2: "SOC 2 Type II within last 12 months"
        1: "Multiple certifications (SOC 2 + ISO 27001), strong program"

    regulatory_expos

… (nội dung đầy đủ có trong gói tải về)