CC9.2 Assessing and managing vendor and business partner risk
Risk from vendors and business partners is assessed and managed. Points of focus: engagement requirements cover scope and specification, roles, compliance duties and service levels; risks from vendors, partners and their own vendors are assessed periodically; responsibility for managing them is assigned; communication, resolution and exception-handling protocols are set; vendor and partner performance is assessed and issues are addressed; relationships are ended through defined procedures; in confidentiality engagements, confidentiality commitments consistent with the organisation's own are obtained and compliance checked; and in privacy engagements, privacy commitments are obtained, compliance assessed and corrective action taken. The 2022 revision adds: evaluating vulnerabilities created by vendor and partner relationships, including their access to the organisation's systems and network connections; keeping an inventory of vendors and partners and tiering them; considering threats such as a vendor's financial collapse, its security weaknesses, disruption to its operations, or its inability to satisfy business or regulatory obligations; setting review frequency by each vendor's risk; and ending relationships under procedures set in advance, which can cover getting data back securely and having it deleted from the vendor's systems.
Source: SOC 2 (2017 Trust Services Criteria), CC9.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.
These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Periodic vendor performance and risk reviews, and offboarding records · HR system / LMS
periodic reviewEvidence produced at each review
- Due diligence records, for example vendor SOC reports reviewed with complementary controls noted · Vendor register / contract repository
- Exit records confirming return and deletion of data held by former vendors · Vendor register / contract repository
governing documentDocuments that govern the control
- Vendor inventory with risk tiers and the review frequency set for each tier · Vendor register / contract repository
- Contracts with security, confidentiality and privacy clauses · Vendor register / contract repository
- Register of third-party access paths and network connections into the organisation's systems · Vendor register / contract repository
First move
Common gaps auditors find
- Critical vendors with no annual review
- Vendor SOC reports collected but complementary user entity controls never assessed
- Contracts missing breach notification or confidentiality terms
- Vendor remote access and network links not inventoried
- Data left with a vendor after the contract ended
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCC9.1 Mitigating risks of business disruption · P1.1 Privacy notice to data subjects