FAQ: What should happen after we approve a vendor?

Assign an owner to keep the review current and follow up when circumstances change. Triggers can include:

New data or system access.
A significant incident.
A change to an important subprovider.
Repeated service failures.

Set a review schedule that fits the risk and applicable obligations. Review sooner when a meaningful change occurs.

For services you depend on, keep an exit plan covering data retrieval, replacement time, access removal, and continuing data-retention obligations. Those steps still need to be completed when the contract ends.

Read more: What Does Third-Party Risk Management Cover Beyond Reviewing a Vendor?.

Additional FAQs

What belongs in a simple SOC 2 control register?

Use one row per control with a stable identifier, a plain-language description, an owner, a frequency or trigger, and an evidence location. Add the relevant criteria mapping, the systems covered,

Can our SOC 2 auditor also help us prepare?

Some preparation assistance may be possible, but independence needs to be evaluated for the actual services and relationships. Ask the CPA firm to explain the permitted scope of help and

Who should own SOC 2 controls in a small company?

Assign ownership to the person who can actually make the process work. HR may own onboarding records, engineering may own deployment approvals, and a business leader may own risk decisions.

What is fourth-party risk?

Fourth-party risk is the risk to your organization from a supplier your vendor relies on. For example, your payroll provider may use a separate hosting company. An outage or security

We have a SOC 2. How much effort is GDPR?

Estimate the extra effort by mapping the personal-data activities and GDPR obligations that apply, then comparing them with your existing controls and evidence. Sort the gaps into three groups: already

When is SSAE-18 Effective?

SSAE-18 became effective for practitioners’ reports dated on or after May 1, 2017.

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide