Real defensibility starts with knowing who your vendors are. While some organizations maintain a central list of all of their vendors, many other organizations do not. Accounts Payable or Finance are excellent places to start the process of compiling a vendor list. With the proper explanation, department or business unit heads can be made partners in the process of preparing a comprehensive list for import. 

We have started a process of assessing the risk of our vendors using a tool called S2Vendor by SecurityStudio®.This will ensure the safety of the information we handle both internally and for our customers. 

Vendor risk management is a major initiative for our organization and we require your help in taking the first step towards defensibility – collecting all of our vendors in 1 place. Currently, there is no central list of the various contractors, vendors, software, suppliers that we use. We cannot protect against what we don’t know.

Please take some time to fill out the attached form with all the vendors you currently use within your business unit. If you are unsure if a potential vendor should be included in this list, please include them so that the Risk Manager can assess the situation themselves. 

For each vendor, you will notice a column asking for a relationship member to be assigned. At a later date, this team member will be responsible for answering a few basic questions on the vendor. If nobody specifically knows the vendor in question, please make the relationship owner, the business unit head. Vendors can be reassigned to alternate relationship owners later.

Feel free to reach out if you have any questions about our new vendor risk management process.

Thanks,