Make a quick list of who can touch your business’s data or systems, and it’s longer than your employee roster: the software vendors hosting your files, the payroll company holding every SSN, the copier firm with a box on your network, the machine vendor with a remote connection from 2021, your IT provider with the keys to everything. Each one is a door into your business that someone else locks — and some of the most damaging breaches on record walked through exactly such doors. Vendor risk management at enterprise scale is a department; at small-business scale it’s an inventory, a tiering decision, five questions, and two standing rules. Here’s the whole practice.

Why your size doesn’t exempt you

The comforting thought is that vendor breaches are a big-company problem. The mechanics say otherwise: when a vendor gets breached, their whole client list inherits the incident, size-blind — your data in their systems is exposed at their security level, not yours. And the obligations flow downhill to you: breach-notification laws, HIPAA business-associate duties, the FTC Safeguards Rule’s explicit vendor-oversight requirement, and — increasingly — your cyber insurance application, which asks how you vet third parties. “Our vendor lost it” is not a defense anyone accepts; legally and reputationally, it’s your breach with extra steps.

Step one: the inventory (you mostly already have it)

If you’ve done the SaaS inventory and the data-classification map, vendor risk is largely a join of the two: every vendor, what data of yours they hold or touch, and — the column people forget — what access they have into your environment: remote connections, network devices they manage, admin accounts, physical access. The forgotten-access column is where the surprises live; most businesses cannot list their standing vendor connections, which means nobody is watching them.

Step two: tier ruthlessly, then match the effort

Diligence applied evenly is diligence abandoned by March. Three tiers:

  • Critical — holds Restricted data or has access into your systems: the payroll provider, the EHR or practice platform, the IT provider, anything with a remote connection. Full treatment.
  • Important — holds Internal data or supports operations: most SaaS tools, the phone vendor. The five questions, at signing and at renewal.
  • Routine — no data, no access: the landscaper, the supplies vendor. A straight face and a purchase order.

Step three: the five questions (for Critical and Important)

Skip the 200-item questionnaire nobody answers honestly. Five questions predict most of it:

  1. Where does our data live, and is it encrypted? Vague answers to the easiest question in security are themselves the answer.
  2. Do you support MFA / single sign-on for our accounts? A vendor that can’t protect your login to them in 2026 has told you about everything else.
  3. Have you had a breach, and can you share a security overview or SOC 2? Practiced answers are fine; wounded evasion is a finding. (Same diligence as any vendor selection — this is just the security column.)
  4. How would you notify us of an incident, and how fast? Get it in the contract for Critical vendors — your notification clocks start whether or not the vendor calls promptly.
  5. What happens to our data when we leave? Export path, deletion timeline. The exit question, as always, predicts the relationship.

For Critical vendors, add the paperwork the answers deserve: security terms in the agreement, a BAA where health data is involved, and a calendar note to re-ask at renewal — vendors’ security postures drift, in both directions.

Step four: the two standing rules for vendor access

The questions cover vendors holding your data; different rules cover vendors reaching into your systems, and they’re stricter:

Rule one: no standing, unwatched connections. Vendor remote access gets enabled when needed, disabled after, logged so usage is visible, and never a shared always-on account. The connection installed for the 2021 project and never revisited is the canonical vendor-breach path.

Rule two: vendor accounts get offboarded like employees. Named accounts per vendor technician where possible, expiration dates set at creation, and a place on the departure checklist when the relationship ends. The quarterly stale-account sweep catches what slips.

And yes — your IT provider belongs at the top of the Critical tier, holding more access than anyone. Ask us, or whoever you use, all five questions plus the access rules. A provider uncomfortable being scrutinized has answered question three for you; the good ones expect it and arrive with the SOC 2 already attached. (Here’s how we secure ourselves.)

The bottom line

Your security perimeter now includes every company you’ve handed data or keys to — that’s not a choice, just a fact of how business runs. The manageable response: one inventory with an access column, three tiers, five questions asked where they’re due, and vendor access governed like the doors it is. A day to build, an hour a quarter to keep — and the next time a vendor’s name is in the breach headlines, you’ll be checking a list instead of your pulse.