BG Beter Geregeld ICT
Security zonder IT-afdeling · 2 min leestijd · 04 December 2025

Vendor risk management for SMBs: a practical framework

Every SaaS subscription is a slice of risk you're outsourcing. How do you decide which of your 30 vendors actually deserve closer attention?

Vendor risk (or third-party risk) is the risk that a supplier causes problems for your business: a data breach, downtime, or a compliance issue. As an SMB, you simply can't give all 30 of your vendors the same level of scrutiny.

\n\n

Tier classification

\n
    \n
  • Tier 1 — critical: processes personal data or is business-critical. M365, accounting, CRM, hosting.
    • \n
  • Tier 2 — important: supports key processes and has access to business data. Slack, design tools, payroll.
    • \n
  • Tier 3 — low risk: standalone tools with no customer data or essential role. LinkedIn Premium, video-editing tools.
    • \n
\n\n

Requirements per tier

\n
    \n
  • Tier 1: ISO 27001 or SOC 2 report (reviewed annually), DPA, uptime SLA, incident-notification agreement.
    • \n
  • Tier 2: DPA, basic security attestation.
    • \n
  • Tier 3: privacy policy check only.
    • \n
\n\n

Annual vendor review

\n
    \n
  1. Update the vendor list from your SaaS inventory.
    2. \n
  2. Review Tier 1 vendors: is their certification still current? Any new sub-processors? Any incident history?
    3. \n
  3. Spot-check Tier 2: is the DPA still up to date?
    4. \n
  4. Report findings to management.
    5. \n
\n\n

Onboarding a new vendor

\n
    \n
  • Determine the tier before signing the contract.
    • \n
  • Tier 1 vendors: conduct due diligence upfront (trust page, security questionnaire, references).
    • \n
  • Tier 2–3: standard DPA and privacy check.
    • \n
\n\n

See also: SaaS inventory, DPAs.

Onderwerpen

#security #compliance #vendor-risk #third-party

Volledige gids: Seguridad para pymes sin departamento de TI: ¿qué haces este trimestre?

Dit artikel is onderdeel van onze uitgebreide Security zonder IT-afdeling-gids. Lees de pillar voor het complete plaatje.

Lees de pillar →

Verwant leesmateriaal

Security zonder IT-afdeling

Security for SMBs without an IT department: what should you do this quarter?

No IT team, but still accountable. This pillar gives you a priority stack: do this first, then that, then the less urgent stuff. Each item links to a deeper guide.

2 min
Security zonder IT-afdeling

Choosing a password manager for your SMB: what really matters?

Choosing a password manager isn't a matter of taste — but it's not rocket science either. A practical guide for business owners without an IT department.

6 min
Security zonder IT-afdeling

Uptime monitoring for SMBs: don't hear about it from your customers

Your website is down and you find out from a customer. There's a better way. Here's how to set up uptime monitoring as an SMB without an IT department — without drowning in false alerts.

6 min
Security zonder IT-afdeling

Patch management for SMBs without MDM muscle

Patches need to go on. But how do you enforce that without Intune or Jamf? Here's the pragmatic minimum setup.

2 min
Security zonder IT-afdeling

MFA for every SaaS tool, not just M365: catching up the stragglers

M365 and Google make MFA easy. So do Dropbox, Slack, GitHub, and Trello. But those other SaaS tools? MFA is often missing. Here's how to close the gap.

2 min
Security zonder IT-afdeling

Security awareness training: what works and what's a waste of time

An annual 60-minute security video is a waste of time. Quarterly 10-minute targeted sessions actually work. Here's the programme that gets results.

2 min
← Alle artikelen in "Security zonder IT-afdeling"