The three questions VRM answers
- Who do we rely on?
- What would hurt if they fell over?
- What evidence do we hold that they're safe today?
The typical VRM toolkit
A vendor register, a tiering framework, an evidence pack per tier, a review cadence and a way to react quickly to incidents. That's it. Everything else is enhancement.
How VRM sits alongside TPRM
'Vendor' typically means someone you pay. 'Third-party' includes vendors, partners, resellers and integrations. VRM is a subset of TPRM, and for many teams they're used interchangeably.
Frequently asked questions
Put this into practice today.
Start a free Credbase workspace, add your first supplier and share a live evidence pack in ten minutes.