VND-006 Vendor Monitoring and Performance Review
Description
Vendor performance, security posture, and compliance with contractual security obligations are reviewed at defined intervals (at least annually) and upon significant changes. Reviews include assessment of incident history, audit reports, certifications, and service delivery against SLAs. Findings are documented and escalated where material deficiencies are identified.
Rationale
Vendor risk is not static. A supplier that passed initial due diligence may deteriorate over time. Ongoing monitoring ensures the organisation detects changes before they become material risks.
Applicability (9 profiles)
VND-006 stays the review of the suppliers the organisation itself buys from. The inversion RTS 2024/1773 Art. 9(2), point (a) asks for, the provider producing periodic, incident, service delivery, ICT security and business continuity testing reports for the customer, is VND-014 since S8 wave B (EX-97 folded there).
Framework Mappings (24)
| STA-12 | Supply Chain Agreement Review | full |
| STA-13 | Supply Chain Compliance Assessment | full |
| STA-14 | Supply Chain Service Agreement Compliance | partial |
| STA-15 | Supply Chain Governance Review | partial |
| STA-12 | Supply Chain Agreement Review | full |
| STA-13 | Supply Chain Compliance Assessment | full |
| STA-14 | Supply Chain Service Agreement Compliance | partial |
| STA-15 | Supply Chain Governance Review | partial |
| DORA-Art.28.6 | Exercise of access, inspection and audit rights | informative |
| DORA-RTS-2024/1773-Art.9.1 | Monitoring measures and key indicators in the contract | informative |
| 5.22 | Monitoring, review and change management of supplier services | full |
| NIS2-Art.21.2.d | Supply Chain Security | informative |
| NIS2-Art.21.3 | Supplier-Specific Risk Factors in Supply Chain Measures | informative |
| NIS2-CIR-5.1 | Supply Chain Security Policy | informative |
| CA-2(3) | Control Assessments | Leveraging Results from External Organizations | partial |
| SA-9 | External System Services | informative |
| SR-6 | Supplier Assessments and Reviews | full |
| GV-6.1-003 | Third-Party AI Risk Policies | GV-6.1-003 | informative |
| GV-6.1-009 | Third-Party AI Risk Policies | GV-6.1-009 | informative |
| GV-6.2-002 | Third-Party Failure Contingency Processes | GV-6.2-002 | informative |
| GV-6.2-004 | Third-Party Failure Contingency Processes | GV-6.2-004 | informative |
| MP-5.2-002 | External Impact Feedback Practices | MP-5.2-002 | full |
| MANAGE 3.1 | Third-Party AI Risk Monitoring and Controls | partial |
| CC9.2 | Vendor and Business Partner Risk Management | informative |
Evidence (2)
Completed vendor review records documenting periodic reassessment of vendor security posture, compliance, and contractual adherence.
Example: Annual vendor review records (vendor management system / Jira) for top-tier vendors from the last 12 months, each showing: review date, reviewer, security posture re-assessment (updated SOC 2 / SIG questionnaire), SLA performance review, incident history check, and any escalated findings with resolution status
Test: Request vendor review records for 5 critical vendors over the last 12 months. Verify: (1) a formal review was conducted for each vendor within the last 12 months, (2) each review includes a security posture assessment (updated certificate or questionnaire response), (3) any identified deficiencies are tracked to resolution, (4) review was signed off by a named owner (procurement, security, or risk team).
Vendor risk register or monitoring report showing current risk ratings for all active vendors with trend information.
Example: Vendor Risk Register (SecurityScorecard / Vanta / spreadsheet), showing all active vendors with current risk tier, last assessment date, open findings, and score trend (improved / stable / deteriorated) over the last 12 months
Test: Request the vendor risk register. Verify: (1) all active vendors with access to organisational data are present, (2) each vendor has a current risk rating with a review date within 12 months, (3) any vendors rated High or Critical risk have documented remediation plans or exit justifications, (4) register is maintained by a named owner.
Questions (3)
Are vendor security posture and contractual performance reviewed at defined intervals of at least annually?
Reviews should include: updated security certifications or questionnaire responses, incident history check, SLA performance, and any open findings from the previous review. Material deficiencies should be escalated and tracked to resolution.
What triggers a vendor security review outside of the regular annual cycle?
Event-triggered reviews are critical because vendor risk does not change on a fixed annual schedule. Vendor breaches and significant service changes should always trigger an unscheduled reassessment.
Which of the following does each vendor review record?
Options run from the most commonly recorded to the least. A review that reads the current certificate and nothing else repeats the pre-engagement assessment rather than testing the relationship since.