Third-Party and SaaS Vendor Risk Program Setup

A vendor risk management program — third-party risk management, or TPRM, in larger-company vocabulary — is the documented, repeatable way an organization decides which service providers may hold its data or connect to its systems, checks that they protect it, and rechecks them over time. You are being asked for one because the frameworks converged: the FTC Safeguards Rule, NYDFS Part 500, HIPAA, PCI DSS, SOC 2 and CMMC all contain a service-provider oversight requirement, and cyber-insurance carriers now ask about it on the application. An auditor or examiner who once accepted 'we have contracts' now expects a list, a tiering rationale, evidence on file and a reassessment date. This engagement builds exactly that, sized so a compliance officer with a day job can keep it running.

In short: the FTC Safeguards Rule (16 CFR 314.4(f)) requires you to select service providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess them based on the risk they present. NYDFS Part 500 (§500.11) requires written third-party service provider policies covering identification and risk assessment, minimum cybersecurity practices, due diligence and periodic reassessment, with due-diligence guidance that reaches access controls, encryption and breach notice. HIPAA requires a business associate agreement with any vendor that creates, receives, maintains or transmits PHI for you. PCI DSS v4.0.1 Requirement 12.8 requires a list of the third-party service providers that touch account data, written agreements, due diligence before engagement, a program that monitors each provider's PCI DSS compliance status at least once every twelve months, and a record of which requirements each party manages. SOC 2's CC9.2 asks how you assess and manage vendor and business-partner risk. The CMMC program rule brings external service providers that handle CUI or security protection data into your assessment scope, with cloud providers that store CUI expected to meet FedRAMP Moderate or an equivalent. Those are our readings at the time of writing; counsel decides what applies to you, and the framework-mapping pack says which artifact answers which clause.

From three sources that never agree. First, cloud-application traffic: Microsoft Defender for Cloud Apps — fed by Defender for Endpoint on your managed devices where licensed, or by firewall and proxy logs — or the Cloud App Discovery subset included with Entra ID P1, matched against Microsoft's catalog of cloud apps with risk scores, showing which apps are used, by whom and how much. Second, Microsoft Entra ID: the enterprise applications registered in your tenant and the user and admin consent grants behind them, which is where an integration that can read mail or files is visible even when nobody remembers approving it. Third, twelve months of accounts-payable and expense records, which catch the vendors that never touch the tenant at all. We merge the three, remove duplicates, attach an owner to each entry and hand you the deltas. The list is always longer than anyone expected, and it is the single most useful artifact of the engagement.

No. The inventory works on Microsoft 365 Business Premium or E3, because Cloud App Discovery — the discovery subset of Defender for Cloud Apps — is included with Microsoft Entra ID P1 and accepts firewall and proxy log uploads for ongoing reporting against Microsoft's cloud-app catalog. The full Defender for Cloud Apps license, in Microsoft 365 E5, the Defender Suite or as a standalone add-on, adds the native Defender for Endpoint feed, which removes the need for log exports, plus OAuth app governance and the controls that turn discovery into policy. We verify what your tenant surfaces at kickoff and tell you plainly what a license would add; if you want the fuller product deployed properly, that is the separate Defender for Cloud Apps implementation. Any Microsoft license is billed by Microsoft or your CSP at Microsoft's published price; it is never part of this fee.

The model scores three things: the sensitivity of the data the vendor holds or can reach, with regulated data — PHI, cardholder data, nonpublic personal information, CUI — at the top; how critical the service is to operations, measured by what stops if it fails; and how deeply it is integrated with your identity and data, from single sign-on and API or OAuth access down to a vendor that only ever receives a purchase order. The scores set the tier, the tier sets the questionnaire depth and the reassessment frequency, and the reasoning is written next to every assignment so an auditor can follow it. You decide the thresholds and the tiers in a working session with us; the model is a proposal until you approve it, and it is written so you can re-tier a vendor yourself when its role changes.

We write your questionnaire set to cover the same domains those questionnaires cover, so you own it outright and can issue it from your own tenant. The Standard Information Gathering questionnaire (SIG) from Shared Assessments is a licensed product — an organization sending it needs a Shared Assessments license, although a vendor answering one does not — and the Cloud Security Alliance's CAIQ is free but written for cloud providers to self-assess against the Cloud Controls Matrix. If you already hold a SIG license, or a customer or regulator expects SIG Lite specifically, we build the program around it. Either way, a vendor that answers with a completed SIG or CAIQ instead of your questionnaire is a good sign, and the evidence-review procedure tells your team how to accept one.

That is the outcome you want, and the procedure is built for it. Your team checks the report type — a Type I describes controls at a point in time, a Type II tests them over a period — and the period covered, reads the auditor's opinion, lists every exception and what the vendor said about it, extracts the complementary user-entity controls the report expects you to implement (they are your obligations, and they surface in the register), notes the subservice organizations carved out of the report, and confirms the report's scope actually covers the service you buy. The same checklist approach applies to an ISO/IEC 27001 certificate (scope statement, certification body, expiry), a PCI Attestation of Compliance (which services, which date, which assessor), a HIPAA Business Associate Agreement and a Data Processing Addendum. A report is filed as evidence with its review date and its gaps, never as a substitute for thinking.

By default in your own tenant, as a SharePoint list built with Microsoft Lists: one row per vendor, columns for owner, tier, data types, integration, evidence on file, contract and renewal dates, questionnaire status, findings, risk rating, decision and next review date, with views for the compliance officer, procurement and the auditor, version history on every change and reminders for reviews and renewals. A spreadsheet has no owner, no history and no reminders, which is how last year's program becomes this year's audit finding. If you hold the Purview licensing, the same structure can be a custom assessment in Microsoft Purview Compliance Manager — in preview at the time of writing — with its improvement actions and evidence uploads; if you already run a GRC platform, we build the register there and do not sell you another one. In every case the register is yours, in a system you own, whoever runs the program later.

Up to 10 tier-1 vendors in the first wave — the number is set so that your team can genuinely do the work alongside us rather than watch. Every vendor in the inventory is tiered; the first wave is where the questionnaire, the evidence review and the risk decision are exercised end to end on your real vendors. After handover, further vendors are assessed by your team using the procedure, or by us in batches quoted at our published hourly rate or as a fixed batch price agreed in writing before we start.

Yes, and usually the largest one. Microsoft is tiered like any other provider — for most customers it is tier 1 by data sensitivity alone — and the evidence-review procedure shows your team where Microsoft publishes its evidence: the SOC and ISO audit reports on the Service Trust Portal, and the Data Protection Addendum and Product Terms that carry the HIPAA business associate terms for in-scope services. The register records that evidence with its dates like any other vendor's. What the program does not do is assess how your own tenant is configured; that is the readiness assessment for your framework, and the two are designed to sit side by side in the auditor's binder.

No single engagement makes an organization compliant with anything, and we will not tell you otherwise to close a sale. Each of those frameworks has many elements; this program builds and evidences the service-provider oversight element — the inventory, the risk-based assessment, the contractual-safeguards checklist and the periodic reassessment — and the framework-mapping pack shows an examiner or auditor exactly where each artifact answers each clause. Your own controls, your written information security program, your incident response plan and the legal determinations are separate work, some of it ours and some of it counsel's. The conclusion about compliance belongs to the regulator, the auditor, the QSA or the carrier; the evidence is what we make complete and honest.

Yes. The FTC's June 2025 Safeguards Rule FAQs for auto dealers addressed this directly: a vendor does not stop being a service provider because a manufacturer mandated it, so a manufacturer-required DMS, CRM or digital-retailing platform that handles customer information still needs the contractual safeguards and the periodic assessment the rule requires — while the manufacturer itself is generally not your service provider merely because it receives customer data from you, unless it provides you a financial service. That is our reading of the FTC's guidance at the time of writing, and your counsel's reading governs. In practice, mandated vendors are tiered and assessed like any other, and where a vendor will not engage with a questionnaire the register records the evidence you could obtain — often a SOC 2 report or a security overview the vendor publishes — and the risk decision you made on it.

Your organization, by design. The procedure document and RACI name who onboards a new vendor, who issues the questionnaire, who reviews evidence, who signs risk acceptances and who runs the reassessment calendar; the register's reminders do the nagging. The first wave exists so that the people named in the RACI have done each step once with an engineer beside them. If you would rather not staff it, the Compliance Evidence and Audit Readiness Retainer can keep the evidence refreshed and the reassessments on schedule for a flat monthly fee, and the Virtual CISO can own the program's decisions; both are optional, month to month, and everything stays in your tenant if you stop.

They answer different questions. The Shadow IT Assessment Workshop and its remote edition use Defender for Cloud Apps to discover unmanaged cloud use and give IT a visibility-and-control roadmap — a discovery engagement for the IT team. The Defender for Cloud Apps implementation configures the product itself: app policies, session controls, Conditional Access App Control, DLP across SaaS. This engagement builds the governance program that a compliance officer, procurement and the business run: tiering, questionnaires, evidence review, contracts, risk decisions and a register an auditor can read. It uses discovery as an input; it does not replace either of those, and a workshop's findings drop straight into its inventory.

They go in the same inventory and the same tiers, with a few extra questions. An AI vendor, or an existing vendor that has added an AI feature, is assessed on what data it receives, whether your data is used to train models shared with other customers, where processing happens, how prompts and outputs are retained, and whether the feature can be switched off contractually — questions the tier-1 questionnaire carries in its AI section. Discovery from Defender for Cloud Apps sees the generative-AI apps your users reach, which is why they appear in the inventory whether or not anyone signed a contract. We wrote about the Microsoft-side controls in Shadow AI is already in your Microsoft 365 tenant — control it with Purview; the vendor-side governance is this program.

Because the scope is fixed: one organization, one Microsoft 365 tenant, the three-source inventory, the tiering model, the questionnaire set, the procedures, the register and a first wave of up to 10 tier-1 vendors, in three weeks. The price is quoted in writing before work begins and you pay after you approve delivery. If you have several legal entities or tenants, a larger first wave or a GRC platform that needs configuration work, we say so on the scoping call and quote the difference before anything starts — not after. And there is no lock-in in either direction: the register, the templates and the procedures are yours whether or not you ever engage us again.