What Comes Next With This Vendor?

About this interactive

The Vendor Management lesson treats a vendor relationship as a life cycle with a beginning, a middle and an end. The beginning comes before any vendor is chosen. First, gather requirements: what the business actually needs, written down before anyone falls for a sales call or a conference demo. Then assess the vendors and products that could meet those requirements, and select one. Then negotiate and sign the contracts and agreements. The middle starts with onboarding, which can be quick for simple software and long for a complex project. After that comes the ongoing work of managing and monitoring: paying the vendor and checking that it does what the contract says. When the service has to change, the change goes through change management with the vendor, and monitoring picks up again on whatever changed. The end is contract termination. Relationships rarely last forever, and when one ends, the work on a replacement starts again at requirements. A quick test for each card: which stage is this relationship in now, and was a stage skipped on the way?

What you'll learn

Place a moment in one vendor relationship in the vendor management life cycle and choose what should happen next
Catch a skipped stage, such as buying from a demo before gathering requirements or signing before assessing other vendors
Follow the loop between managing and monitoring a vendor and change management, and the restart of the life cycle when a contract ends

Aligned to

CompTIA Security+

5.3 Explain the processes associated with third-party risk assessment and management.

NIST CSF

GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.

GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.

GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or supply chain relationship.

Key terms

Vendor Management Life Cycle: The end-to-end process of managing vendor relationships from requirements gathering and vendor assessment through onboarding, ongoing monitoring, change management, and contract termination.
Requirements Gathering: The process of identifying and documenting organizational needs before selecting a vendor or product to ensure the solution aligns with business objectives.
Vendor Assessment: The evaluation of potential vendors to determine whether they can meet an organization's defined requirements.
Change Management: A structured process for requesting, reviewing, approving, and documenting changes to IT systems or organizational procedures. Change management reduces security risk by ensuring modifications are tested and authorized before deployment.
Contract Termination: The formal end of a vendor relationship or agreement, marking the conclusion of the vendor management life cycle.

Topics

Vendor Management Interactive Predict

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →