Vendor Check (Legal/Contractual Paperwork Status)

Vendor Check (Legal/Contractual Paperwork Status)

Consolidated view of what's signed, missing, and expiring with a vendor across all systems.

When to use vs. operations:vendor-review

This is the most-confused vendor cluster pair. Memorize the split:

Often used together; different outputs and stakeholders.

Boundary tie-breaker

What this skill produces

1. Document inventory

Per vendor:

2. Gap analysis (tiered)

Each gap is classified by remediation urgency:

• Tier 1 — Stop-the-bus: Block further data flow until cured (e.g., DPA missing while PII flowing; BAA missing while PHI flowing; expired cyber COI on a high-risk vendor)
• Tier 2 — Cure within 30 days: Material gap but not actively leaking liability (stale SOC 2 with no bridge letter; missing pen-test attestation on prod-access vendor)
• Tier 3 — Backlog: Hygiene improvement (missing W-9 reconfirm; outdated security questionnaire by < 1 quarter)

What's missing given relationship type:

• Vendor processes personal data (any jurisdiction) → DPA required (GDPR Art. 28; CCPA service-provider terms)
• Vendor processes PR-resident PII → DPA + verify breach-notification flow-down (PR Ley 111-2005 — controller must notify DACO and affected residents; processor must notify controller without unreasonable delay)
• Vendor processes PHI → BAA (HIPAA 45 CFR 164.504(e))
• Vendor handles payment cards → PCI-DSS AOC + scope confirmation
• Vendor has admin access to production systems → Pen-test attestation + SOC 2 Type II + right-to-audit + breach-notification clause with ≤72hr SLA
• Vendor is a sub-processor under a customer DPA → 30-day customer notice obligation; sub-processor list must be public or notice list maintained
• Vendor in restricted jurisdiction (outside adequacy) → SCCs / IDTA / data transfer mechanism + transfer impact assessment
• Vendor amount > materiality threshold → Insurance COI on file (general + cyber); minimum limits per MSA
• Vendor multi-year commitment → Termination-for-convenience window confirmed
• Cyber-insurance carrier requires vendor warranties → Confirm vendor meets policy's "vendor warranty" schedule (encryption, MFA, backup, IR plan); missing = potential coverage denial
• Vendor delivers software to us → SBOM + vulnerability disclosure policy + license-compliance scan
• Vendor has access to source code → IP assignment + code-handling/destruction clause

3. Surviving obligations register

Even after termination, what survives. Track each with its specific clock:

3a. Termination action template

For each terminated vendor, produce a dated checklist:

Day 0  (notice given): Confirm wind-down period in MSA/DPA, freeze new SOWs, notify InfoSec to revoke access on Day X.
Day 7:  Send data-return-format request (CSV/JSON/parquet, encryption in transit).
Day 30: Confirm receipt of data; request destruction certificate if applicable.
Day 60: Confirm sub-processor purge; confirm vendor's sub-processors also destroy.
Day 90: Destruction certificate received and filed; close vendor in CLM with surviving-obligation watch list (NDA, IP, indemnity, audit-tail).
Year 1+: Calendar reminders for any tail clocks (audit rights, indemnification, NDA expiry).

3b. Sub-processor change protocol

When vendor announces a new sub-processor:

1. Check our customer DPAs for sub-processor notice obligation (typical: 30-day prior notice with right to object).
2. Push notice to affected customers within their contractual window.
3. Update sub-processor list in own DPA / trust center.
4. If customer objects: coordinate with vendor on alternative routing or accept termination right.
5. Confirm new sub-processor meets our security baseline (encryption, location, certifications).

4. Upcoming deadlines

Forward view with owner:

• Auto-renewal notice deadlines (often 30–90 days before renewal — set calendar reminder)
• Termination-for-convenience windows
• Annual obligations: COI refresh, SOC 2 refresh, pen-test refresh, security questionnaire, sub-processor review
• Pricing review windows
• Customer DPA notice windows triggered by sub-processor changes

When to chain to other skills

• About to negotiate a new vendor agreement: chain to legal:review-contract
• Deciding renewal vs. switch: chain to operations:vendor-review
• DPA missing and vendor processes personal data: chain to legal:legal-risk-assessment for the privacy exposure score
• About to onboard new vendor: chain to operations:vendor-review first (decision), then this skill (paperwork) once decided
• Suspected vendor security incident: chain to legal:legal-risk-assessment (notification clocks) and operations:risk-assessment (containment)

Decline triggers (do NOT use this skill if)

• Question is "should we use vendor X" (decision) → operations:vendor-review
• Question is "negotiate this clause with vendor X" (redline) → legal:review-contract
• Question is "what's the legal exposure if X fails" (risk score) → legal:legal-risk-assessment
• Question is "did X have an outage last week" (operational telemetry) → ops/observability tools

Tools that should be connected for best output

• CLM (Ironclad, Spotdraft, ContractWorks, Concord) — primary source
• CRM with vendor records
• Document storage (Box, Drive, SharePoint, Egnyte) — for older agreements not yet in CLM
• Email — for vendor correspondence and informal commitments
• Procurement system (Coupa, Airbase, Ramp) — spend signal
• Security GRC (Vanta, Drata, Secureframe) — for SOC 2, pen-test, vendor-risk records
• Cyber-insurance policy on file — to confirm vendor warranty schedule

Output formats (pick based on prompt)

• Vendor snapshot — full inventory + gap analysis + upcoming deadlines
• Gap deep-dive — one missing document analyzed with remediation steps
• Renewal package — what's needed for the renewal decision
• Termination package — surviving obligations checklist if relationship ends
• Cross-vendor summary — across all vendors, where are the highest-risk gaps (prioritized by data sensitivity × access scope × paperwork gap)
• Customer-DPA flow-down audit — verify each sub-processor meets your customer DPAs' security/notice requirements