Vendor Management
VM-06Review vendors on the cadence their tier sets
How Leela would run itAnnual · annual for Tier 1 and 2; at renewal for Tier 3
From the policy libraryThe requirement
Critical providers are reviewed at least annually with a site visit or video walkthrough and a refreshed SOC 2 or comparable attestation; material vendors annually from documentation; standard vendors at renewal or material change. Each review covers performance, financial condition, attestations, incidents, and proposed changes.
- Applies
- Tell Leela about your company to see whether this applies.
- Status
- Setup needed
Tell Leela how you handle it today, or hand it over: see what’s next.
The work
Schedule each vendor’s review from its tier, collect the current attestation and financials, hold the walkthrough for critical providers, and record the outcome in the inventory.
What Leela keepsThe evidence this obligation leaves, as the work happens
Listed from the policy libraryContents
- 01Annual review recordPer vendor: date, reviewer, attestation received, findings, outcome
- 02Current SOC 2 or comparable attestationReport covering the current period, on file
Evidence
Annual review record
Vendor Management §5.5
2
of 2 records
The work and the records come from this obligation in the policy library.