sickn33/agentic-awesome-skills/vendor-management

vendor_risk_tiers:
  critical:
    criteria:
      - Processes or stores sensitive/regulated data (PII, PHI, PCI)
      - Single point of failure (no alternative vendor)
      - Has privileged access to production systems
      - Handles authentication or security-critical functions
    assessment_requirements:
      - Full security questionnaire (SIG or custom)
      - SOC 2 Type II report review (or equivalent)
      - Penetration test results review
      - On-site or virtual security assessment (optional)
      - Business continuity and DR plan review
    review_frequency: Annual
    contract_requirements:
      - Data processing agreement (DPA)
      - Business associate agreement (BAA) if PHI
      - Security SLA with breach notification timeline
      - Right to audit clause
      - Cyber insurance requirements
    examples:
      - Cloud infrastructure providers (AWS, Azure, GCP)
      - Identity providers (Okta, Azure AD)
      - Payment processors (Stripe, Adyen)
      - Primary database or CRM SaaS
 
  high:
    criteria:
      - Accesses significant company data (internal or confidential)
      - Integrates with production systems via API
      - Processes customer-facing transactions
      - Substitution would cause significant business disruption
    assessment_requirements:
      - Security questionnaire
      - SOC 2 report review (Type I or Type II)
      - Compliance certifications verified
    review_frequency: Annual
    contract_requirements:
      - Data processing agreement
      - Security requirements appendix
      - Incident notification clause (72 hours)
    examples:
      - Email/marketing platforms (SendGrid, HubSpot)
      - Monitoring and logging SaaS (Datadog, Splunk)
      - CI/CD platforms (GitHub, GitLab)
      - Customer support platforms
 
  medium:
    criteria:
      - Limited data access (internal data only)
      - Non-production system integration
      - Some business impact if unavailable
    assessment_requirements:
      - Abbreviated security questionnaire
      - Compliance certification verification
    review_frequency: Every 2 years
    contract_requirements:
      - Standard vendor terms with security clause
      - NDA
    examples:
      - Project management tools
      - HR platforms
      - Travel and expense systems
 
  low:
    criteria:
      - No access to company data
      - No system integration
      - Easily replaceable
    assessment_requirements:
      - Basic due diligence (public info review)
      - Confirm no data sharing
    review_frequency: Every 3 years or on renewal
    contract_requirements:
      - Standard terms
    examples:
      - Office supply vendors
      - Facilities services
      - General consulting (no data access)

security_questionnaire:
  section_1_governance:
    questions:
      - "Do you have a documented information security policy?"
      - "Is there a designated CISO or security lead?"
      - "Do you conduct annual security risk assessments?"
      - "Do you have a security awareness training program?"
      - "What compliance certifications do you hold? (SOC 2, ISO 27001, etc.)"
      - "When was your last external security audit?"
      - "Do you carry cyber liability insurance? What coverage limits?"
    evidence_requested:
      - Information security policy (or summary)
      - SOC 2 Type II report (or bridge letter)
      - ISO 27001 certificate
      - Cyber insurance certificate
 
  section_2_access_control:
    questions:
      - "How do you manage user access to systems containing our data?"
      - "Is multi-factor authentication enforced for all personnel?"
      - "How frequently do you conduct access reviews?"
      - "What is your process for revoking access upon employee termination?"
      - "Do you support SSO/SAML integration for customer access?"
      - "How do you manage privileged access?"
    evidence_requested:
      - Access management policy
      - MFA configuration documentation
      - Access review records (sample)
 
  section_3_data_protection:
    questions:
      - "How is our data encrypted at rest?"
      - "How is our data encrypted in transit?"
      - "In which geographic regions is our data stored?"
      - "Do you use sub-processors? If so, provide a list."
      - "What is your data retention policy?"
      - "How is our data isolated from other customers? (multi-tenancy model)"
      - "Can you provide data export in standard formats upon request?"
      - "What is your data destruction process at contract end?"
    evidence_requested:
      - Encryption standards documentation
      - Sub-processor list
      - Data flow diagram showing customer data handling
 
  section_4_vulnerability_management:
    questions:
      - "How frequently do you perform vulnerability scans?"
      - "How frequently do you conduct penetration tests?"
      - "What is your patch management SLA for critical vulnerabilities?"
      - "Do you have a responsible disclosure or bug bounty program?"
      - "How do you manage vulnerabilities in third-party dependencies?"
    evidence_requested:
      - Penetration test executive summary (last 12 months)
      - Vulnerability management policy
      - Patch management SLA documentation
 
  section_5_incident_response:
    questions:
      - "Do you have a documented incident response plan?"
      - "What is your breach notification timeline?"
      - "Have you experienced a data breach in the last 3 years?"
      - "How would you notify us in the event of a security incident?"
      - "Do you conduct incident response tabletop exercises?"
    evidence_requested:
      - Incident response plan summary
      - Breach notification procedure
 
  section_6_business_continuity:
    questions:
      - "Do you have a business continuity plan?"
      - "Do you have a disaster recovery plan?"
      - "What are your RTO and RPO targets?"
      - "How frequently do you test your DR plan?"
      - "What is your uptime SLA?"
      - "Do you have geographic redundancy?"
    evidence_requested:
      - BCP/DR plan summary
      - Uptime SLA documentation
      - Most recent DR test results
 
  section_7_compliance:
    questions:
      - "Do you process data subject to GDPR, HIPAA, or PCI DSS?"
      - "How do you support our compliance obligations?"
      - "Do you have a Data Processing Agreement (DPA) template?"
      - "How do you handle data subject access requests (DSARs)?"
      - "Are you FedRAMP authorized? If so, at what impact level?"
    evidence_requested:
      - DPA template
      - Compliance certification documentation

risk_scoring:
  dimensions:
    data_sensitivity:
      weight: 30
      scores:
        1: "No access to company or customer data"
        2: "Access to public or non-sensitive internal data"
        3: "Access to internal confidential data"
        4: "Access to PII or customer financial data"
        5: "Access to regulated data (PHI, PCI, classified)"
 
    system_access:
      weight: 25
      scores:
        1: "No system access"
        2: "Read-only access to non-production"
        3: "Read/write access to non-production or read-only production"
        4: "Read/write access to production systems"
        5: "Privileged/admin access to production or security systems"
 
    business_criticality:
      weight: 20
      scores:
        1: "No operational dependency"
        2: "Minor convenience; easily replaced"
        3: "Moderate dependency; replacement in weeks"
        4: "Significant dependency; replacement in months"
        5: "Critical dependency; no viable alternative"
 
    security_posture:
      weight: 15
      scores:
        5: "No certifications, no formal security program"
        4: "Some security controls but no external validation"
        3: "SOC 2 Type I or equivalent"
        2: "SOC 2 Type II within last 12 months"
        1: "Multiple certifications (SOC 2 + ISO 27001), strong program"
 
    regulatory_exposure:
      weight: 10
      scores:
        1: "No regulatory requirements"
        2: "General data protection (GDPR basic)"
        3: "Industry-specific (HIPAA, PCI)"
        4: "Government (FedRAMP, ITAR)"
        5: "Multiple stringent regulations"
 
  calculation:
    formula: "Sum of (dimension_score * dimension_weight) / 100"
    risk_levels:
      low: "1.0 <= score <= 2.0"
      medium: "2.0 < score <= 3.0"
      high: "3.0 < score <= 4.0"
      critical: "4.0 < score <= 5.0"
 
  example:
    vendor: "Payment Processor X"
    data_sensitivity: 5  # PCI data
    system_access: 4     # Production API integration
    business_criticality: 5  # No alternative
    security_posture: 2  # SOC 2 Type II
    regulatory_exposure: 3   # PCI DSS
    score: "(5*30 + 4*25 + 5*20 + 2*15 + 3*10) / 100 = 4.1 -> Critical"

vendor_registry_schema:
  vendor_info:
    vendor_id: "VND-NNNN"
    vendor_name: ""
    vendor_website: ""
    primary_contact_email: ""
    security_contact_email: ""
    vendor_category: ""  # SaaS, IaaS, Consulting, etc.
 
  risk_assessment:
    risk_tier: ""  # critical, high, medium, low
    risk_score: null # unknown until assessed
    last_assessment_date: ""
    next_assessment_date: ""
    assessment_status: ""  # current, due, overdue
    open_findings: 0
    certifications:
      - type: "SOC 2 Type II"
        valid_until: ""
        report_on_file: null # verify
      - type: "ISO 27001"
        valid_until: ""
        certificate_on_file: null # verify
 
  contract:
    contract_id: ""
    start_date: ""
    end_date: ""
    auto_renewal: true
    cancellation_notice_days: 90
    annual_value: 0
    terms:
      data_processing_agreement: true
      nda: true
      baa: false
      right_to_audit: true
      breach_notification_sla: "72 hours"
      data_return_clause: true
      data_destruction_clause: true
      cyber_insurance_required: true
 
  data_access:
    data_types: []
    data_classification: ""
    data_location: []
    sub_processors: []
 
  sla_tracking:
    uptime_sla: "99.9%"
    actual_uptime_last_month: ""
    support_response_sla: ""
    sla_breaches_ytd: 0
 
  status: ""  # active, under_review, offboarding, inactive
  owner: ""   # Internal team/person responsible

"""
Vendor SLA monitoring - Track uptime and response time commitments.
"""
import requests
from datetime import datetime, timezone