Vendor Risk Management.

The subset of third-party risk management focused on assessing and overseeing direct suppliers, particularly their security, privacy, and operational resilience practices. It belongs to the Compliance & Frameworks category of cybersecurity.

The subset of third-party risk management focused on assessing and overseeing direct suppliers, particularly their security, privacy, and operational resilience practices.

Vendor risk management (VRM) is the operational core of TPRM applied to suppliers an organization contracts with directly. It typically combines an inventory of vendors, inherent risk classification (data sensitivity, criticality, access scope), pre-contract assessments, contractual obligations, periodic reassessments, and incident management. Tools include security questionnaires (SIG, CAIQ), SOC 2 / ISO 27001 reviews, security ratings, and on-site or remote audits. VRM contributes to resilience by reducing concentration risk, ensuring breach notification clauses, and verifying that vendors meet privacy, financial, and regulatory requirements. While TPRM is broader (including n-th parties, partners, and intra-group entities), VRM is often where most procurement-driven activity happens.

Defences for Vendor Risk Management typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: VRM, Supplier risk management.