Photo: AgainErick / Wikimedia Commons, CC BY-SA 4.0
Every small business depends on other businesses. Your accountant has your financial records. Your payroll provider has every employee’s Social Security number and bank details. Your IT provider has administrator access to your systems. Your scheduling app, CRM, point-of-sale system and website host all hold pieces of your data. Each of those relationships is a door into your business, and you do not control the lock.
That is what vendor and third-party risk means: the chance that a weakness at someone you work with becomes a problem for you. When a vendor is breached, your customers rarely care whose fault it was. They trusted you with their information, and regulators and contracts usually see it the same way.
Large companies manage this with dedicated teams and expensive platforms. You do not need either. This guide shows how to build a right-sized vendor risk program using a spreadsheet, a short questionnaire, a few contract clauses and an annual review, all achievable on a small budget.
Key takeaways
- Start with an inventory: you cannot manage risk from vendors you have not listed.
- Sort vendors into tiers based on what data and access they have, and focus your effort on the critical few.
- Use a short questionnaire and existing evidence, such as SOC 2 reports or PCI attestations, instead of building a heavy assessment process.
- Put breach notification, data handling and security expectations into contracts, including HIPAA business associate agreements where required.
- Limit vendor access to what they need, require MFA and remove access promptly when a relationship ends.
Why your vendors are your risk
Attackers have learned that it is often easier to go through a supplier than to attack a target directly. A single compromised IT provider, software update or cloud service can expose hundreds of downstream customers at once. US and allied cybersecurity agencies have issued joint guidance warning that managed service providers are attractive targets for exactly this reason.
For a small business, third-party risk typically comes from a few categories:
- Vendors with access to your systems: managed IT providers, software consultants, website developers, remote support tools.
- Vendors that store your data: cloud apps, payroll and HR platforms, accounting software, CRMs, file-sharing services, backup providers.
- Vendors that process payments: payment processors, e-commerce platforms, point-of-sale providers.
- Professional services: accountants, lawyers, consultants and marketing agencies who receive sensitive files by email.
- Vendors you depend on to operate: internet providers, hosting companies and line-of-business software, where an outage stops you working even if no data is lost.
The NIST Cybersecurity Framework 2.0 now treats supply chain risk management as part of its “Govern” function, a signal that managing suppliers is considered a core part of security, not an optional extra.
Step 1: Build a vendor inventory
Start with a simple spreadsheet. The fastest way to find vendors is to look at where money goes: export a year of payments from your accounting system and credit card statements, then add free tools people signed up for on their own. Ask each department, “What apps or services do you log into for work?”
Use columns like these:
| Column | Example entry |
|---|---|
| Vendor name | Payroll provider |
| What they do for us | Runs payroll and tax filings |
| Data they hold | Employee names, SSNs, bank accounts, salaries |
| Access to our systems | None (we upload data to their portal) |
| Internal owner | Office manager |
| Contract or terms location | Shared drive / Contracts / Payroll |
| Security evidence on file | SOC 2 Type II report, dated last year |
| Tier | Critical |
| Next review date | March |
Assign an internal owner for every vendor. That person does not need to be technical. Their job is to know why the vendor is used, keep the contract handy and trigger a review when something changes.
Step 2: Tier your vendors by risk
Treating every vendor the same wastes time. The office coffee delivery service and your IT provider do not deserve the same scrutiny. Sort vendors into three tiers.
| Tier | Criteria | What to do |
|---|---|---|
| Critical | Holds sensitive or regulated data (health, card, financial, SSNs), has admin access to your systems, or would stop operations if unavailable. | Full questionnaire, review security evidence, strong contract terms, annual review. |
| Moderate | Holds some business or customer data, or has limited access. | Short questionnaire or review of public security page, confirm MFA and breach notification, review every two years. |
| Low | No meaningful data and no system access. | Record in inventory; no further review needed unless that changes. |
Most small businesses end up with a handful of critical vendors, typically their IT provider, email and file platform, payroll, accounting and any system that holds customer or patient records. That is where your effort should go.
Step 3: Do right-sized due diligence
Large vendors receive hundreds of security questionnaires and often publish the answers on a trust or security page. Check there first. For smaller vendors, a short list of direct questions tells you most of what you need to know.
A 10-question vendor security questionnaire
- Do you require multi-factor authentication for all staff who can access our data or systems?
- Is our data encrypted in transit and at rest?
- Do you have an independent security assessment, such as a SOC 2 Type II report or ISO/IEC 27001 certification? Can you share it?
- How quickly will you notify us if you have a security incident affecting our data?
- Do you use subcontractors or other providers who can access our data? Which ones?
- Where is our data stored, and who on your team can access it?
- How do you back up data, and how often do you test restoring it?
- How do you handle security updates and patching?
- Do your employees receive security awareness training?
- How will you return or delete our data if we end the relationship?
Understanding the evidence vendors provide
- SOC 2 Type II: an independent auditor’s report on how well the vendor’s security controls operated over a period of time, usually six to twelve months. A Type I report only covers a single point in time, so Type II is stronger.
- ISO/IEC 27001: an international certification showing the vendor runs a formal information security management system. Check that the certificate’s scope covers the service you use.
- PCI DSS Attestation of Compliance: relevant for anyone handling payment card data on your behalf.
- Penetration test summaries: useful, but less meaningful than an audit report on their own.
When a small vendor has no formal certification, that is not automatically a deal-breaker. Their answers to the questionnaire, their willingness to discuss security openly and their contract commitments matter more. A vendor who will not answer basic questions about MFA or breach notification is telling you something important.
Step 4: Put security into contracts
Contracts are where expectations become enforceable. For critical vendors, check that the agreement, or an addendum, covers:
- Breach notification within a defined timeframe, such as 72 hours, with details of what happened and what data was affected.
- A commitment to reasonable security measures, ideally referencing specific controls such as MFA and encryption.
- Limits on how the vendor can use your data, including no selling or secondary use.
- Disclosure of subcontractors and responsibility for their security.
- Return or certified deletion of your data when the contract ends.
- Your right to request security evidence, such as an updated SOC 2 report, each year.
- Cyber liability insurance carried by the vendor, for higher-risk relationships.
- A HIPAA business associate agreement (BAA) if the vendor handles protected health information.
- A data processing agreement if GDPR applies to the personal data the vendor processes for you.
Many cloud providers use standard terms you cannot negotiate. In that case, read their security and data processing terms, make sure they meet your obligations, and record any gaps as accepted risks. For more on what regulations require, see our guide to GDPR, HIPAA and PCI DSS for small businesses.
Step 5: Control vendor access
Even a trustworthy vendor can be compromised. Limiting what their accounts can do limits the damage if that happens.
- Give each vendor its own named accounts. Never share your staff logins, and avoid one generic “vendor” account used by several people.
- Require MFA on every vendor account that can access your systems.
- Grant the least access needed. A website developer does not need access to your accounting system.
- Use time-limited access for one-off projects, and disable accounts when the work is done.
- Know which remote access tools are installed. Ask your IT provider to list every remote management or remote support tool on your computers and who can use it.
- Review third-party app connections. In Microsoft 365 and Google Workspace, check which apps have been granted access to mail, files or calendars, and remove ones you do not recognize.
- Send sensitive files securely through a shared portal or encrypted link, rather than as ordinary email attachments.
Watch out
Your IT provider is often your most powerful vendor. They typically hold administrator access to every system, and their remote management tools can push software to every computer you own. Ask them directly how they protect their own environment: whether their technicians use MFA, how access to your systems is logged and what happens if one of their accounts is compromised. A good provider will welcome the question.
Step 6: Monitor and review over time
Vendor risk is not a one-time project. Relationships change, vendors get acquired, and new services get added without anyone updating the list. Build a simple rhythm:
- Annually: review critical vendors, request updated security evidence and confirm contacts and contract terms.
- Every two years: review moderate vendors.
- Whenever you add a vendor: add it to the inventory, assign a tier and complete the appropriate review before sharing data.
- When a vendor announces a breach: confirm whether your data was affected, change any shared credentials and follow your incident response plan if needed.
- When a vendor is acquired or changes ownership: recheck where data is stored and whether contract terms still apply.
Setting news alerts for your critical vendors’ names is a free way to learn about problems early.
Step 7: Offboard vendors cleanly
Ended relationships leave behind forgotten accounts and copies of data. When you stop using a vendor:
- Disable or delete their accounts in your systems and remove any remote access tools they installed.
- Revoke API keys, app connections and shared passwords, and rotate any passwords they knew.
- Request return or deletion of your data, and get written confirmation.
- Export any data you need to keep before closing the account.
- Update the inventory to show the relationship has ended.
For broader reading, the UK National Cyber Security Centre’s supply chain security guidance sets out practical principles that scale down well to small organizations.
How SecuritySage can help
If you are not sure where to start, we can help you build your vendor inventory, tier your suppliers and review the evidence your critical vendors provide. Our IT security audits include a review of third-party access to your systems, and our Virtual CISO advisory service can run your vendor review process on an ongoing basis. The Security Policy Toolkit includes templates you can adapt for your own vendor management policy.
Ready to take control of your supply chain risk? Get started with SecuritySage and we will help you focus on the vendors that matter most. Secure your digital future today with SecuritySage, where cybersecurity meets simplicity, allowing you to focus on growth while we handle the rest.
Frequently asked questions
What is third-party risk for a small business?
Third-party risk is the chance that a weakness at a vendor, supplier or service provider causes a security incident, data breach or outage for your business. It includes IT providers with access to your systems, cloud apps that store your data and professional firms that receive sensitive files. Your customers and regulators usually hold you responsible even when a vendor is at fault.
How do I start a vendor risk management program with no budget?
Start with a spreadsheet listing every vendor, what data they hold and what access they have. Sort them into critical, moderate and low tiers, then focus on the critical ones with a short security questionnaire and a review of their contract terms. Repeat the review annually.
What is a SOC 2 report and should I ask vendors for one?
A SOC 2 report is an independent auditor's assessment of a service provider's security controls. A Type II report covers how controls operated over a period of months, making it more meaningful than a Type I report, which covers a single point in time. It is reasonable to request one from critical vendors, though smaller vendors may not have one and can be assessed through a questionnaire instead.
What security clauses should vendor contracts include?
Key clauses include breach notification within a defined timeframe, commitments to reasonable security measures, limits on data use, disclosure of subcontractors and return or deletion of data at the end of the contract. If a vendor handles protected health information, you also need a HIPAA business associate agreement. If GDPR applies, include a data processing agreement.
