What best describes vendor onboarding?

• A. Bringing a vendor into the program, including due diligence, contracts, access management, and data handling requirements
• B. Auditing only after incidents
• C. Decommissioning a vendor
• D. Selecting vendors by price

Answer: (A)

Vendor onboarding is the process of bringing a supplier into your program with the necessary controls and agreements in place before they can operate in your environment. It starts with due diligence to assess risk, security posture, compliance, and fit with your policies. It then moves to contract negotiation and governance to establish roles, responsibilities, and oversight. Access management ensures the vendor is granted the appropriate permissions only for what they need, following the principle of least privilege. Data handling requirements set expectations for data protection, classification, transfer, retention, and incident response. When all these elements are aligned, the vendor can work with your organization securely and compliantly.

Auditing only after incidents is reactive and happens after a problem arises, which isn’t onboarding. Decommissioning a vendor is the end of the relationship, not the onboarding phase. Selecting vendors by price ignores security and compliance readiness and misses the onboarding steps that ensure a safe, controlled onboarding process. The described approach—bringing the vendor into the program with due diligence, contracts, access management, and data handling requirements—best captures what onboarding is.