vendorSubject
Vendor
A third party whose product, service or integration the organization uses. Signals about a vendor describe the people exposed through it: who granted it access, who owns the integration and who is affected when it is breached.
Example
A note-taking SaaS app connected to the company directory through an OAuth grant.
Indicators (28, first 20 shown)
20- Violates security contract clauses I.0384
- Fails to meet security standards I.0385
- Grants excessive access privileges I.0386
- Uses unmonitored API integrations I.0387
- Uses unapproved cloud providers I.0388
- Disposes sensitive data improperly I.0389
- Employs unverified subcontractors I.0390
- Operates domain on watchlist I.0391
- Has history of security breaches I.0392
- Lacks continuous security monitoring I.0393
- Supplies or operates vulnerable software or platforms I.0394
- Lacks secure development practices I.0395
- Faces financial or legal instability I.0396
- Skips insider background screening I.0397
- Exhibits unusual access patterns I.0398
- Uses shared or generic credentials I.0399
- Lacks monitoring of insider activity I.0400
- Fails to report employee departures I.0401
- Delays breach notification I.0402
- Transfers data without logging I.0403
Cite this term
"Vendor" (vendor), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/subjects/vendor
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.