> For the complete documentation index, see [llms.txt](https://docs.flosum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flosum.com/resources/policies-and-security/corporate-policies-and-security-compliance/product-level-certifications/backup-and-archive/flosum-backup-and-archive-security-and-compliance-statement/vendor-risk-management.md). # Vendor Risk Management The Vendor Risk Management department is responsible for establishing, implementing, managing, and enforcing the enterprise-wide vendor management program designed to identify and mitigate risks to an acceptable level that may result from vendor relationships. The Vendor Risk Management Program defined herein encompasses the following activities: #### Procurement Minimum vendor evaluation and verification requirements are defined within the procurement process. Procurement controls include: * Due Diligence - Conduct initial review of potential vendors to ensure the provider is capable of maintaining appropriate safeguards, financial stability, and availability required for the proposed services. * Vendor Classification - Define the classification of the vendor based on the scope of services, criticality, and sensitivity of information needed to perform services. * Contractual Requirements - Ensure vendor contracts have required contractual clauses that define information security program obligations, ownership of data and rights to obtain control. #### Monitoring Once engaged in a vendor relationship, Flosum performs ongoing targeted monitoring activities. The scope and extent of monitoring activities is dictated by the vendor classification. Monitoring activities are designed to verify vendor obligations are being met, the financial condition is stable, vendor controls are functioning as expected, and no changes have occurred that would negatively impact or change the risk position of the vendor. On an annual basis, the results of detailed control assessments are re-confirmed with each vendor to validate that the classification of the vendor and the vendor's control environment have not changed from the initial assessment. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.flosum.com/resources/policies-and-security/corporate-policies-and-security-compliance/product-level-certifications/backup-and-archive/flosum-backup-and-archive-security-and-compliance-statement/vendor-risk-management.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.