What is involved in vendor onboarding and what are essential controls?

• A. Bringing a vendor into the program; due diligence, contract/SLAs, access management, and data handling requirements
• B. Negotiating discount terms only
• C. Conducting sanctions screening only
• D. Setting up hardware procurement

Answer: (A)

Vendor onboarding is the process of bringing a supplier into your organization in a controlled, risk-aware way. It goes beyond a one-time signup and sets up the ongoing protection and governance of the relationship. The strongest answer reflects this holistic approach: you onboard a vendor by establishing formal due diligence to assess risk and capability, creating contract terms and service level agreements that spell out responsibilities, performance, security, and data protections, implementing access management to ensure only authorized vendor personnel can reach your systems, and defining data handling requirements so data is processed, stored, transmitted, and disposed of securely. Together, these elements create a clear, enforceable framework that minimizes risk, protects sensitive information, and ensures accountability throughout the vendor relationship. Other options focus on narrow activities—discount terms, sanctions screening, or hardware procurement—which don’t address the full governance, security, and data-protection controls that onboard a vendor responsibly.