Vendor risk register update cadence
Overview
Vendors drift—SOC2 expires, breaches happen, products sunset.
Cadence
Annual deep review high/critical; semi-annual light touch medium; continuous monitoring news alerts critical subset.
Fields
Risk tier, last review, next review, certifications on file, open issues, successor plan.
Triggers
Vendor merger, price hike >20% (reevaluate alternatives), service outage major.
Escalation
Procurement + security joint decision log for renewals >50k.
Tooling
GRC platform optional maturity; spreadsheet acceptable early stage with discipline.
Exit
Offboarding vendor checklist parallels client offboarding—data return clauses fired.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...