Scope
This guide covers vendor risk management controls required under SOC 2 and ISO/IEC 27001:2022, focusing on third-party security oversight, contract requirements, and incident response obligations. It addresses Clause 6.1.2 (risk assessment) and Annex A Control 5.19 through 5.23 (supplier relationships) in ISO/IEC 27001, and the Common Criteria regarding vendor management in SOC 2 Trust Services Criteria.
The Labcorp settlement, which involved a $2.3 million penalty and security reforms following a 2019 breach at vendor AMCA that exposed 10.2 million customer records, illustrates the consequences of inadequate vendor oversight. Use this guide to build controls that withstand both auditor scrutiny and real-world vendor incidents.
Key Concepts and Definitions
Service Provider: Any third party that processes, stores, or transmits data on your behalf. This includes SaaS platforms, debt collectors, payment processors, and hosting providers.
Complementary Subservice Organization Controls (Complementary Subservice Organization Controls): Controls performed by your vendors that you rely on to meet your own control objectives. If a vendor fails, you own that gap.
Vendor Security Assessment: A documented evaluation of a vendor's security posture before contract execution and periodically thereafter. ISO/IEC 27001:2022 Annex A Control 5.20 requires this assessment to address information security risks in the supply chain.
Incident Response Plan for Vendor Failures: A documented procedure for detecting, containing, and remediating security incidents originating from third-party systems. The Labcorp settlement explicitly required this capability.
Requirements Breakdown
ISO/IEC 27001:2022
Clause 6.1.2(c): You must evaluate risks associated with external parties who access your information assets. This is part of your mandatory risk assessment process.
Annex A Control 5.19 (Information Security in Supplier Agreements): Your contracts must define security requirements, including acceptable use, access controls, incident notification timelines, and audit rights. Generic boilerplate doesn't satisfy this control.
Annex A Control 5.20 (Addressing Information Security Within Supplier Agreements): Establish processes to monitor, review, and audit supplier compliance with security requirements. The Labcorp settlement mandated that vendors "routinely provide audits documenting their compliance", your ISO certification auditor will expect similar evidence.
Annex A Control 5.21 (Managing Information Security in the ICT Supply Chain): Address security throughout the supply chain lifecycle, including onboarding, ongoing monitoring, and offboarding.
SOC 2 Trust Services Criteria
CC9.1: You must establish requirements for vendor services, including security, availability, and confidentiality commitments.
CC9.2: Your vendor evaluation process must assess the vendor's ability to meet your service commitments. This means reviewing their SOC 2 reports, penetration test results, and security questionnaires before you sign.
CC9.3: You must monitor vendor performance against contractual obligations. If you can't demonstrate ongoing oversight, you'll receive a qualified opinion or exception.
Implementation Guidance
Pre-Contract Phase
Start with a tiered classification system. Not every vendor requires the same scrutiny. A SaaS tool that never touches customer data needs lighter review than a payment processor handling cardholder information.
For high-risk vendors, require a current SOC 2 Type II report or ISO/IEC 27001 certificate. Review the actual report, don't just check a box that one exists. Look for exceptions, Complementary Subservice Organization Controls you must implement, and whether the scope covers the services you're purchasing.
Build security requirements directly into your RFP and master services agreement templates. The Labcorp settlement required "cybersecurity requirements in vendor contracts", your contract should specify encryption standards (reference FIPS-Validated Cryptography where appropriate), access control requirements, incident notification windows (24-48 hours is standard), and your right to audit or review third-party assessments.
Ongoing Monitoring
Create a vendor inventory that documents: vendor name, services provided, data classification, contract renewal date, last security assessment date, and assigned risk tier. Update this quarterly.
For critical vendors, request annual attestations confirming they maintain security controls consistent with their initial assessment. If they hold SOC 2 or ISO/IEC 27001 certification, verify the certificate hasn't lapsed.
The Labcorp settlement required building "an expansive risk management team charged with tracking vendors' compliance", you don't need a large team, but you do need assigned ownership. Designate a vendor risk manager or split responsibility across your GRC function.
Incident Response Integration
Your incident response plan must address vendor-originated incidents. Document:
- How you'll learn about a vendor breach (notification requirements in your contract)
- Who receives vendor incident notifications (create a dedicated email address)
- Decision criteria for activating your own incident response procedures
- Communication templates for notifying affected customers or regulators
- Evidence preservation requirements for potential legal action
The AMCA breach impacted 27.5 million people across multiple AMCA clients, but Labcorp bore legal responsibility for the 10.2 million records it had entrusted to AMCA. Your incident response plan must account for this liability transfer.
Common Pitfalls
Relying on vendor self-attestation without verification: A completed security questionnaire isn't evidence. Request supporting documentation, SOC 2 reports, penetration test summaries, or ISO/IEC 27001 certificates.
Failing to define data minimization requirements: The Labcorp settlement required "limiting how much data Labcorp shares with vendors." Your contracts should specify the minimum data set required for service delivery. If a vendor requests access to entire database exports, push back.
Ignoring data aggregation risks: The settlement required Labcorp to "begin siloing data that debt collectors often aggregate for several clients at once." If your vendor commingles your data with other customers' data, you've introduced concentration risk. Document this in your risk register and require logical separation controls.
Missing contract renewal cycles: Vendor risk assessments expire. If you assessed a vendor three years ago and auto-renewed without reassessment, you're out of compliance with Annex A Control 5.20.
No escalation path for vendor nonconformities: When a vendor fails a security assessment or misses a contractual obligation, what happens? Your process must define remediation timelines and contract termination triggers.
Quick Reference Table
| Control Area | ISO/IEC 27001:2022 | SOC 2 Criteria | Key Evidence |
|---|---|---|---|
| Vendor selection criteria | Annex A 5.20 | CC9.1, CC9.2 | Risk assessment methodology, vendor questionnaire template |
| Contract security terms | Annex A 5.19 | CC9.1 | MSA with security exhibit, SLA definitions |
| Ongoing monitoring | Annex A 5.20, 5.21 | CC9.3 | Vendor inventory, assessment schedule, review meeting notes |
| Incident notification | Annex A 5.24 | CC7.3, CC7.4 | Contract notification clauses, incident response plan |
| Access reviews | Annex A 5.18 | CC6.2 | Quarterly vendor access reports, termination procedures |
| Performance evaluation | Clause 9.1 | CC9.3 | Annual vendor scorecards, SLA compliance reports |
| Risk treatment | Clause 6.1.3 | CC3.3 | Risk register with vendor-specific entries, treatment plans |
You'll reference this table during audit prep. Keep your evidence organized by control area, and maintain a narrative document explaining how each piece of evidence demonstrates compliance.
The Labcorp settlement serves as your cautionary blueprint. Build vendor controls that assume vendor failure is inevitable, not theoretical. Your audit opinion depends on it.
