Vendor Risk Management for the Companies That Hold Your Data
Vendor risk management from Granite Tech tells you which outside companies can reach your data and systems, how much each one can reach, and whether the ones that matter most actually protect it. We build the vendor inventory, tier every vendor by its access, review the critical ones, and write it all down, as one layer of the cybersecurity services we run for Montana businesses.
Your vendors are part of your security perimeter
Payroll services, practice software, cloud platforms, payment processors, and IT companies all hold some piece of your business: employee records, customer data, financial accounts, or an administrator login. If one of them is breached, your business is exposed, no matter how well you have locked down your own office. Many small business breaches arrive this way, through a vendor that had legitimate access.
Vendor risk management is the structured work of knowing who those vendors are, what each one can reach, and how well each one protects it, then keeping a written record that shows customers, regulators, and your insurer that you did your homework. For our managed IT services clients, Granite Tech handles the technology side of that work so it does not fall to an office manager with a spreadsheet and no time.
Every vendor, software subscription, and service provider in one list, with the contact, contract dates, and renewal notice window for each.
Admin, read-only, or none, plus whether the vendor touches regulated data such as financial, health, or employee records.
Critical, important, or low, so review time goes to the payroll provider and not the office supply account.
SOC reports read, security questionnaires sent and scored against your needs, and the findings written down.
Logins, remote tools, and network permissions shut off the day a relationship ends, not months later.
Not every vendor needs the same review
Treating every vendor the same wastes hours on low-risk accounts and shortchanges the ones that hold your most sensitive data. Pick a vendor type to see where it usually lands and how deep the review goes. These are common starting points; the real tier depends on the access each vendor holds in your business.
Payroll provider
Holds Social Security numbers, bank account details, and tax records for every employee, and can move money out of your accounts.
- Current SOC 2 Type II report requested and read
- Security questionnaire on access, encryption, and breach notice
- Multi-factor authentication on your admin logins
- Breach notification terms checked in the contract
When vendor risk turns into your risk
Most owners do not think about vendor security until someone else asks about it. These are the moments that usually bring a business to us.
And the honest answer is that nobody has written it down.
Carriers increasingly want evidence of vendor risk management before they write or renew coverage.
Software vendors, copier companies, and past IT help may all still hold a way in.
Terminated providers stay a threat until their credentials and permissions are revoked.
Auto-renewal clauses lock you into services you may not need, often at a higher rate.
Patient records, financial information, or employee files carry obligations that extend to the companies you share them with.
How we check a critical vendor's security
A critical vendor review rests on two tools. The first is the vendor's SOC report (System and Organization Controls), an independent audit of how the vendor protects customer data. A SOC 2 Type II report covers how those controls performed over a period of months, which tells you more than a Type I snapshot of a single day. We request it, read it, and pull out the exceptions and the parts that apply to how you use the service.
The second is a security questionnaire sent directly to the vendor. It fills the gaps a SOC report leaves, and for smaller vendors without an audit it carries most of the weight. Questionnaires often surface what a vendor never volunteers: outdated encryption, loose access controls, or thin backup practices.
Findings become decisions you can act on: accept the risk and note why, ask the vendor to fix a gap, add security terms at renewal, or start looking for a replacement.
- 1
Do you have a current SOC 2 Type II report, and can you provide it for our review?
- 2
Who in your organization can access our data, and what controls limit and monitor that access?
- 3
How will you notify us of a breach or security incident, and how quickly?
- 4
How is our data encrypted, both where it is stored and while it moves?
- 5
Do you run regular third-party audits or penetration tests, and can we see the findings?
From scattered contracts to a documented vendor program
The first pass takes the most effort. After that, the program runs on a schedule and the record stays current.
Build the inventory
We pull vendors from billing records, software subscriptions, contracts, and the remote access and admin accounts we find on your network, then confirm the list with you.
Map access and tier
Each vendor gets its access level and data type recorded, then a tier of critical, important, or low.
Review critical vendors
SOC reports, questionnaires, and the security terms in each contract, read against how your business uses the service.
Document and repeat
Findings go into a written record, access is checked quarterly, and critical vendors are reviewed again on schedule and before renewal.
Vendor reviews feed directly into your Healthy Business security reviews, so vendor risk is discussed alongside the rest of your security program instead of in a separate binder.
One record for every outside company you depend on
The vendor inventory is the master map of your outside relationships, from your internet provider and payroll software to your security systems and cloud storage. It does not need expensive software. For most small and midsize businesses, a well-organized spreadsheet in a secure, shared location does the job, as long as someone owns it and it stays current.
Each record holds the contract start and end dates, the auto-renewal notice window, the vendor contact, the access level, and whether regulated data is involved. Renewal reminders go on the calendar 60 to 90 days ahead, which gives you room to renegotiate, require security changes, or walk away on your terms. It pairs with your SaaS inventory, and when a renewal turns into a replacement, our IT procurement team can help compare the options.
What shapes the work for your business
What decides scope and cost
The number of vendors you use, how many land in the critical tier, whether regulated data is involved, and how much documentation already exists. Contracts scattered across inboxes take longer to inventory than contracts kept in one folder. Scope and pricing are set out in a written proposal before any work begins.
Regulated industries
Depending on your industry, you may have obligations for how vendors handle your data even when your own controls are sound. Medical practices need a business associate agreement with vendors that handle patient information, and banks and lenders answer for their service providers under GLBA. We support healthcare IT and financial services IT clients with exactly these reviews.
Insurance, audits, and contracts
A written record of vendor reviews shows reasonable care after a breach, during an insurance claim, or in a regulatory audit. It also gives you an informed position at renewal time. We flag where a contract is silent on breach notice, liability, or security duties; the contract language itself belongs with your attorney.
When a vendor relationship ends
Former providers can keep credentials, software access, or network permissions long after the last invoice. We revoke logins and remote tools, remove shared accounts, and confirm what happens to your data, following the same discipline as standardized offboarding for employees.
The kind of vendor we try to be
We are a vendor too, with administrator access to our clients' systems. Ask us the same questions you ask everyone else.
Read the case studiesVendor risk management questions
Vendor risk management is the practice of tracking every outside company with access to your data or systems, ranking them by risk, and checking how well the most important ones protect what they hold. It produces a vendor inventory, a tier for each vendor, and written reviews of your critical vendors. That record is what you show an auditor, insurer, or client who asks how you vet the companies you work with.
A vendor is critical when it holds sensitive data, has administrator access to your systems, or would stop your business if it failed. Payroll providers, EHR and dealer management systems, payment processors, and your IT provider usually qualify. A cloud storage account can move into the critical tier once client, patient, or financial records live there.
Many smaller vendors have never paid for a SOC audit. In that case the security questionnaire carries more of the weight, along with any published security documentation and the security terms in the contract. You then decide, with the gaps written down, whether the risk is acceptable, needs a fix, or calls for a different vendor.
Yes, and small businesses often have the most to gain because they lean on outside vendors for payroll, software, and IT. Once every software subscription is counted, even a small Montana office usually finds a longer vendor list than expected, with a handful of critical vendors in it. Vendor risk management keeps the effort proportional: a full review for the few that matter and a simple inventory line for the rest.
Vendors are one layer of the security program we run for managed IT clients, alongside staff training, email security, endpoint protection, and threat detection. The vendor inventory and review findings are covered in your Healthy Business security reviews, and critical vendor decisions roll into your technology roadmap.
Find out who holds your data
Request a short call to talk through your vendors, the access they hold, and what an auditor or insurer has asked you for. If there is a fit, a written proposal with scope, pricing, and timelines follows.
Or email CustomerCare@granite.tech