vendor-management

Name: vendor-management
Author: BagelHole

42stars4forks

How to install vendor-management?

bagelhole/devops-security-agent-skills/vendor-management

$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill vendor-management

Installs into the current project.

Summary

Implement vendor risk management programs. Assess third-party security and maintain vendor inventory. Use when managing supplier security.

Files · 1

View on GitHub

SKILL.md

1	# Vendor Management
2
3	Implement a vendor risk management program covering vendor assessment questionnaires, risk scoring, contract tracking, SLA monitoring, and ongoing oversight for compliance with SOC 2, ISO 27001, and regulatory frameworks.
4
5	## When to Use
6
7	- Onboarding new vendors that will access company data or systems
8	- Conducting annual vendor risk assessments and reassessments
9	- Negotiating security requirements in vendor contracts
10	- Monitoring vendor SLA compliance and security posture
11	- Preparing vendor management evidence for SOC 2 or ISO 27001 audits
12
13	## Vendor Risk Tiering
14
15	```yaml
16	vendor_risk_tiers:
17	critical:
18	criteria:
19	- Processes or stores sensitive/regulated data (PII, PHI, PCI)
20	- Single point of failure (no alternative vendor)
21	- Has privileged access to production systems
22	- Handles authentication or security-critical functions
23	assessment_requirements:
24	- Full security questionnaire (SIG or custom)
25	- SOC 2 Type II report review (or equivalent)
26	- Penetration test results review
27	- On-site or virtual security assessment (optional)
28	- Business continuity and DR plan review
29	review_frequency: Annual
30	contract_requirements:
31	- Data processing agreement (DPA)
32	- Business associate agreement (BAA) if PHI
33	- Security SLA with breach notification timeline
34	- Right to audit clause
35	- Cyber insurance requirements
36	examples:
37	- Cloud infrastructure providers (AWS, Azure, GCP)
38	- Identity providers (Okta, Azure AD)
39	- Payment processors (Stripe, Adyen)
40	- Primary database or CRM SaaS
41
42	high:
43	criteria:
44	- Accesses significant company data (internal or confidential)
45	- Integrates with production systems via API
46	- Processes customer-facing transactions
47	- Substitution would cause significant business disruption
48	assessment_requirements:
49	- Security questionnaire
50	- SOC 2 report review (Type I or Type II)
51	- Compliance certifications verified
52	review_frequency: Annual
53	contract_requirements:
54	- Data processing agreement
55	- Security requirements appendix
56	- Incident notification clause (72 hours)
57	examples:
58	- Email/marketing platforms (SendGrid, HubSpot)
59	- Monitoring and logging SaaS (Datadog, Splunk)
60	- CI/CD platforms (GitHub, GitLab)
61	- Customer support platforms
62
63	medium:
64	criteria:
65	- Limited data access (internal data only)
66	- Non-production system integration
67	- Some business impact if unavailable
68	assessment_requirements:
69	- Abbreviated security questionnaire
70	- Compliance certification verification
71	review_frequency: Every 2 years
72	contract_requirements:
73	- Standard vendor terms with security clause
74	- NDA
75	examples:
76	- Project management tools
77	- HR platforms
78	- Travel and expense systems
79
80	low:
81	criteria:
82	- No access to company data
83	- No system integration
84	- Easily replaceable
85	assessment_requirements:
86	- Basic due diligence (public info review)
87	- Confirm no data sharing
88	review_frequency: Every 3 years or on renewal
89	contract_requirements:
90	- Standard terms
91	examples:
92	- Office supply vendors
93	- Facilities services
94	- General consulting (no data access)
95	```
96
97	## Vendor Assessment Questionnaire
98
99	```yaml
100	security_questionnaire:
101	section_1_governance:
102	questions:
103	- "Do you have a documented information security policy?"
104	- "Is there a designated CISO or security lead?"
105	- "Do you conduct annual security risk assessments?"
106	- "Do you have a security awareness training program?"
107	- "What compliance certifications do you hold? (SOC 2, ISO 27001, etc.)"
108	- "When was your last external security audit?"
109	- "Do you carry cyber liability insurance? What coverage limits?"
110	evidence_requested:
111	- Information security policy (or summary)
112	- SOC 2 Type II report (or bridge letter)
113	- ISO 27001 certificate
114	- Cyber insurance certificate
115
116	section_2_access_control:
117	questions:
118	- "How do you manage user access to systems containing our data?"
119	- "Is multi-factor authentication enforced for all personnel?"
120	- "How frequently do you conduct access reviews?"
121	- "What is your process for revoking access upon employee termination?"
122	- "Do you support SSO/SAML integration for customer access?"
123	- "How do you manage privileged access?"
124	evidence_requested:
125	- Access management policy
126	- MFA configuration documentation
127	- Access review records (sample)
128
129	section_3_data_protection:
130	questions:
131	- "How is our data encrypted at re

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

vendor-management

42stars4forks

View on GitHub

How to install vendor-management?

bagelhole/devops-security-agent-skills/vendor-management

$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill vendor-management

Installs into the current project.

Summary

Implement vendor risk management programs. Assess third-party security and maintain vendor inventory. Use when managing supplier security.

Files · 1

View on GitHub

SKILL.md

1	# Vendor Management
2
3	Implement a vendor risk management program covering vendor assessment questionnaires, risk scoring, contract tracking, SLA monitoring, and ongoing oversight for compliance with SOC 2, ISO 27001, and regulatory frameworks.
4
5	## When to Use
6
7	- Onboarding new vendors that will access company data or systems
8	- Conducting annual vendor risk assessments and reassessments
9	- Negotiating security requirements in vendor contracts
10	- Monitoring vendor SLA compliance and security posture
11	- Preparing vendor management evidence for SOC 2 or ISO 27001 audits
12
13	## Vendor Risk Tiering
14
15	```yaml
16	vendor_risk_tiers:
17	critical:
18	criteria:
19	- Processes or stores sensitive/regulated data (PII, PHI, PCI)
20	- Single point of failure (no alternative vendor)
21	- Has privileged access to production systems
22	- Handles authentication or security-critical functions
23	assessment_requirements:
24	- Full security questionnaire (SIG or custom)
25	- SOC 2 Type II report review (or equivalent)
26	- Penetration test results review
27	- On-site or virtual security assessment (optional)
28	- Business continuity and DR plan review
29	review_frequency: Annual
30	contract_requirements:
31	- Data processing agreement (DPA)
32	- Business associate agreement (BAA) if PHI
33	- Security SLA with breach notification timeline
34	- Right to audit clause
35	- Cyber insurance requirements
36	examples:
37	- Cloud infrastructure providers (AWS, Azure, GCP)
38	- Identity providers (Okta, Azure AD)
39	- Payment processors (Stripe, Adyen)
40	- Primary database or CRM SaaS
41
42	high:
43	criteria:
44	- Accesses significant company data (internal or confidential)
45	- Integrates with production systems via API
46	- Processes customer-facing transactions
47	- Substitution would cause significant business disruption
48	assessment_requirements:
49	- Security questionnaire
50	- SOC 2 report review (Type I or Type II)
51	- Compliance certifications verified
52	review_frequency: Annual
53	contract_requirements:
54	- Data processing agreement
55	- Security requirements appendix
56	- Incident notification clause (72 hours)
57	examples:
58	- Email/marketing platforms (SendGrid, HubSpot)
59	- Monitoring and logging SaaS (Datadog, Splunk)
60	- CI/CD platforms (GitHub, GitLab)
61	- Customer support platforms
62
63	medium:
64	criteria:
65	- Limited data access (internal data only)
66	- Non-production system integration
67	- Some business impact if unavailable
68	assessment_requirements:
69	- Abbreviated security questionnaire
70	- Compliance certification verification
71	review_frequency: Every 2 years
72	contract_requirements:
73	- Standard vendor terms with security clause
74	- NDA
75	examples:
76	- Project management tools
77	- HR platforms
78	- Travel and expense systems
79
80	low:
81	criteria:
82	- No access to company data
83	- No system integration
84	- Easily replaceable
85	assessment_requirements:
86	- Basic due diligence (public info review)
87	- Confirm no data sharing
88	review_frequency: Every 3 years or on renewal
89	contract_requirements:
90	- Standard terms
91	examples:
92	- Office supply vendors
93	- Facilities services
94	- General consulting (no data access)
95	```
96
97	## Vendor Assessment Questionnaire
98
99	```yaml
100	security_questionnaire:
101	section_1_governance:
102	questions:
103	- "Do you have a documented information security policy?"
104	- "Is there a designated CISO or security lead?"
105	- "Do you conduct annual security risk assessments?"
106	- "Do you have a security awareness training program?"
107	- "What compliance certifications do you hold? (SOC 2, ISO 27001, etc.)"
108	- "When was your last external security audit?"
109	- "Do you carry cyber liability insurance? What coverage limits?"
110	evidence_requested:
111	- Information security policy (or summary)
112	- SOC 2 Type II report (or bridge letter)
113	- ISO 27001 certificate
114	- Cyber insurance certificate
115
116	section_2_access_control:
117	questions:
118	- "How do you manage user access to systems containing our data?"
119	- "Is multi-factor authentication enforced for all personnel?"
120	- "How frequently do you conduct access reviews?"
121	- "What is your process for revoking access upon employee termination?"
122	- "Do you support SSO/SAML integration for customer access?"
123	- "How do you manage privileged access?"
124	evidence_requested:
125	- Access management policy
126	- MFA configuration documentation
127	- Access review records (sample)
128
129	section_3_data_protection:
130	questions:
131	- "How is our data encrypted at re

People who liked this also viewed

6 picks

Type