SOC 2 · CC - Common Criteria (Security)
SOC 2 SOC2-CC9.2: CC9.2 Assessing and managing vendor and business partner risk
SOC 2 SOC2-CC9.2 covers CC9.2 Assessing and managing vendor and business partner risk. The held text names 6 evidence records for it, the first being Vendor inventory with risk tiers and the review frequency set for each tier. The common gap an assessor flags is Critical vendors with no annual review.
Risk from vendors and business partners is assessed and managed. Points of focus: engagement requirements cover scope and specification, roles, compliance duties and service levels; risks from vendors, partners and their own vendors are assessed periodically; responsibility for managing them is assigned; communication, resolution and exception-handling protocols are set; vendor and partner performance is assessed and issues are addressed; relationships are ended through defined procedures; in confidentiality engagements, confidentiality commitments consistent with the organisation's own are obtained and compliance checked; and in privacy engagements, privacy commitments are obtained, compliance assessed and corrective action taken. The 2022 revision adds: evaluating vulnerabilities created by vendor and partner relationships, including their access to the organisation's systems and network connections; keeping an inventory of vendors and partners and tiering them; considering threats such as a vendor's financial collapse, its security weaknesses, disruption to its operations, or its inability to satisfy business or regulatory obligations; setting review frequency by each vendor's risk; and ending relationships under procedures set in advance, which can cover getting data back securely and having it deleted from the vendor's systems.
What evidence supports SOC2-CC9.2?
- Vendor managementVendor inventory with risk tiers and the review frequency set for each tier
- Vendor managementDue diligence records, for example vendor SOC reports reviewed with complementary controls noted
- Vendor managementContracts with security, confidentiality and privacy clauses
- Vendor managementPeriodic vendor performance and risk reviews, and offboarding records
- Vendor managementRegister of third-party access paths and network connections into the organisation's systems
- Vendor managementExit records confirming return and deletion of data held by former vendors
Where this requirement comes from
This is our own statement of SOC 2 SOC2-CC9.2, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Critical vendors with no annual review
- Vendor SOC reports collected but complementary user entity controls never assessed
- Contracts missing breach notification or confidentiality terms
- Vendor remote access and network links not inventoried
- Data left with a vendor after the contract ended
How it maps to ISO 27001:2022
- 5.19 high Assessing and managing vendor and business partner risk is supplier relationship security.
- 5.20 medium Vendor risk management implies agreement terms but SOC 2 does not require specific contract clauses.
- 5.21 medium Vendor risk assessment covers direct suppliers, not the wider ICT supply chain requirement.
- 5.22 high Ongoing assessment and management of vendor risk is monitoring and review of supplier services.
- 5.23 medium Cloud providers fall within vendor risk assessment but cloud acquisition and exit processes are unaddressed.
- 8.30 medium Vendor risk management applies to development outsourcing without addressing code ownership or testing rights.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.