Vendor management in most companies is handled by teams involved in procurement or accounts payable. If you google “vendor management software,” you’ll see the kinds of enterprise tools they use.
However, IT has its own unique interest in vendor management, notably around security risks. We can assure you that the accounts payable team isn’t tracking the cybersecurity risk profile of vendors, nor would you want them to.
So, what should vendor management look like when viewed through the IT lens?
What is vendor management?
Vendor management refers to the processes used by organizations to manage their vendors. This involves various activities like vendor selection, contract negotiation, cost management, service delivery. The whole process is aimed at creating the best vendor management practices that will benefit the organization.
With proper vendor management, organizations can bring down supplier costs, improve service delivery, mitigate potential risks and more. Most importantly, vendor management plays a critical role in meeting business objectives and preventing business disruptions arising out of delivery failures.
The role of IT in vendor management
If you’re on the company’s IT team, you probably care about different things than cost management. Indeed, your take on cost management is that a vendor whose products expose the company to security risks is more expensive in the long run because the direct and indirect costs associated with breaches are astronomical, and the odds of being targeted by cyberattacks are increasing.
What is IT’s role in the vendor management process?
The vendor management process includes a number of activities of which certain elements might vary from one organization to another. Some of the notable steps in the vendor management process an IT pro should undertake are outlined here.
Establish objectives and vendor criteria
The first step is to establish business objectives and determine the criteria for choosing vendors. This stage mainly focuses on aligning the roles of vendors and buyers. When vendors have a clear knowledge of your business objectives, they can serve you better and ensure a seamless flow of inventory. As an IT pro, you should have a seat at the table when procurement decisions are being made because you’re in the best position to assess the cybersecurity risk of different software. It’s also worth having your say on the costs associated with switching vendors, migrating data and other aspects that non-IT folks might not think about.
Vendor selection
You may not have the final say on vendor selection, as IT’s perspective is just one of many, but you need to be aware of the final decision so you can start planning. You may even need certain things to be built into the final negotiation, such as API access to make migration easier.
Vendor documentation
When you allow third-party vendors to access your resources, it exposes your organization to certain risks. This is why vendors must be monitored for various risks such as compliance breaches, data security threats and intellectual property loss. You must also monitor your vendors for potential risks arising from the non-delivery of products or services that might disrupt your company’s operations.
Documenting all of this information will put you in a much better position to understand the risks your organization face when doing business with that particular vendor.
It would be even more beneficial if you’re able to document clearly the information of which users hold licenses for that vendor, what hardware assets the vendor’s software is installed on, the vendor’s technical point of contact and set up security permissions for the admin password to that software.
What are the challenges in vendor management?
There are a lot of things you’ll want to take into account when evaluating vendors from an IT perspective.
Compliance risks
Not all vendors adhere to the compliance regulations set by data privacy laws, exposing you to compliance risks and penalties. You need to choose vendors who meet your compliance standards while also delivering great performance. If your org chooses a vendor that has gaps, you at least need to know what those gaps are — you can’t proactively address problems you don’t know exist.
Data security and other risks
Do your vendors have access to your sensitive information? If yes, to what extent? If you’re aiming for a zero-trust environment, you need to know what they have access to and reconcile that against what they should have access to.
Administrative costs
Having the right process for choosing and managing the right vendors comes with a price. When you manage multiple vendors, you are likely to incur overheads related to project management, vendor support and more. Documentation helps to understand these costs at a vendor level, especially when your documentation is connected to your ticketing system.
Even linking of cost-of-service spreadsheets with vendor profiles in your documentation system will make it easier to point out to other stakeholders when a particular vendor, software application or hardware make is unusually problematic.
Lack of visibility
Managing multiple vendors often generates huge volumes of data. In many cases, organizations do not have a centralized data management solution with full visibility. What you need is a robust documentation solution that can improve documentation efficiency and ensure better visibility.
Make the auditors happy
If there’s one thing auditors love, it’s documentation. So ask yourself — how do you feel with the idea of a cybersecurity audit? Or an insurance company poking around your systems to build a quote for cyber insurance? Documentation ensures any type of audit process is less stressful than usual. You’ll feel better just knowing that you can handle an incident better, let alone that you can prove your capabilities to a third party. If you have documentation but aren’t sure you could find it in an emergency, or you’re worried that there’s a single point of failure (usually a person) somewhere in your response plan, it’s a sign you should get your documentation in order, which is a worthwhile endeavor.
Enhance vendor management with IT Glue
IT Glue is a powerful documentation solution that can help you overcome many challenges associated with vendor management. With IT Glue, you can automatically document your vendor information including name, type, category, importance, risk level. This helps you understand your vendors better and gain the most from what they have to offer.
IT Glue also comes with SSO, IP access control, host-proof hosting, MFA, audit trails and more, all within a SOC 2 Type II compliant solution.
To learn more about how IT Glue can help you with vendor management, request a demo.
