Vendor management: how much should they know?
Every supplier, contractor and SaaS tool you use holds a piece of your business. When one of them is breached, your data is in it, and you find out when they decide to tell you.
You cannot audit a large vendor. You can be deliberate about how many of them there are and how much each one holds.
Do this today
- List every tool and supplier with access to your data or your systems. Include the ones on someone's personal credit card.
- For each, ask two questions: what do they hold, and how long do they keep it after we stop paying?
- Cancel the ones nobody uses, and delete the data on the way out rather than just letting the subscription lapse.
What good looks like
The list exists, it is reviewed when something is added, and someone owns it.
Contractors get their own accounts rather than borrowing a staff member's, so access ends when the contract does.
Want someone to just do this for you? Start a conversation — twenty minutes, free.
Last reviewed: September 2026