In the environments we review, IT vendor management problems often show up on the bill first: Microsoft 365 licenses assigned to nobody, two or three SaaS tools doing the same job, and cloud storage nobody remembers creating. Then you count the vendors themselves. Internet provider, phone system, Microsoft 365, practice management or accounting software, payroll, the copier lease, the camera company, the website host, and a few cloud apps someone signed up for with a company card.
Many of those vendors hold your data, and some can log into your systems. Each one is a cost to manage and a door into your organization, and several rules that apply to small firms now require you to vet and oversee the ones handling sensitive data. This guide covers how to get vendors under control, handle IT procurement more deliberately, and meet those rules.
Key takeaways
- Start with one list of every technology vendor, what it costs, what data it touches and when the contract renews.
- The FTC Safeguards Rule requires covered financial businesses to select capable service providers, require safeguards by contract and periodically assess them.
- HIPAA requires healthcare practices to get written assurances, through a business associate agreement, from vendors that handle patient data.
- Standardizing on a few business-grade hardware models makes support, security and budgeting easier.
- When a vendor relationship ends, get your data back and revoke its access before the contract lapses.
Start IT vendor management with one list
Pull the last year of credit card statements and accounts payable, and add your IT provider’s records. Include free tools staff signed up for. For each vendor, record:
| What to record | Why it matters |
|---|---|
| What it does and who owns the relationship internally | Someone has to answer for renewals and problems |
| Cost, renewal date, notice period and how to cancel | Renewals become decisions instead of surprises |
| What data it stores, and what kind | Tells you which rules apply |
| Whether its staff can log into your systems, and how | Remote access tools and shared passwords are common ways in |
| Risk rank | Vendors with sensitive data or remote access get the closest look, and the toner supplier can wait |
Put renewals on a calendar with reminders well before the cancellation deadline. This one exercise usually turns up forgotten subscriptions and vendors with access nobody remembered. Our post on forgotten cloud resources covers the cloud side of the same cleanup.
Why vendor sprawl is a security problem
Duplicate subscriptions and unused licenses cost money, and every problem takes longer when you first have to work out which vendor is responsible. The bigger issue is risk.
Every vendor with access to your systems or data is part of your security, planned or not. A remote access tool a vendor installed years ago, a shared admin password, or a cloud app holding client files without multifactor authentication can each become the way in. NIST’s Cybersecurity Framework 2.0 now treats supply chain risk management as part of governance. Our guide to securing your supply chain goes further.
What regulators expect from vendor oversight
FTC Safeguards Rule
Tax preparers, mortgage brokers, non-bank lenders and many other financial businesses fall under the FTC Safeguards Rule. It requires you to oversee service providers by taking reasonable steps to select ones capable of protecting customer information, requiring those safeguards in your contracts, and periodically assessing them based on the risk they present.
HIPAA
A healthcare practice may let a business associate handle electronic protected health information only after obtaining satisfactory assurances, documented in a business associate agreement, that the vendor will safeguard it. That covers IT providers, cloud backup services, billing companies and many software vendors. We hold ourselves to the same standard, with signed business associate agreements from every vendor in our stack that can touch PHI. Our healthcare IT page has more.
Professional duties
Law and accounting firms must protect client confidences, and that duty extends to the vendors they choose. Larger clients increasingly send security questionnaires asking how you manage your own vendors.
Keep signed agreements, questionnaires and review notes where you can find them during an audit or insurance renewal. We write policies for our clients, such as data retention and acceptable use, and vendor oversight belongs in the same written program. Our compliance services can help you set it up.
Questions to ask before you sign
- Where is our data stored, and is it encrypted at rest and in transit?
- Do your staff use multifactor authentication, and can our users?
- How, and how quickly, will you tell us about a security incident affecting our data?
- Do subcontractors handle our data, and do they meet the same standards?
- Will you sign a business associate agreement, if we need one?
- How do we get our data back if we leave, and in what format?
- How do your staff access our systems, and can we see a log of that access?
A vendor that can’t answer these clearly, or won’t put the answers in the contract, is telling you something.
Buy hardware and software the same way every time
- Standardize on a small number of business-grade laptop and desktop models. Fewer models means faster support and simpler security.
- Buy business-class lines, which generally come with longer support, better warranties and management features that consumer models lack.
- Check that hardware and software will get security updates for as long as you plan to use them.
- Assign Microsoft 365 and other licenses to people, and reclaim them when someone leaves. As a Microsoft CSP partner, we manage Microsoft 365 licensing for our clients, so they pay only for licenses that are assigned.
- Budget for a steady replacement cycle. We recommend PCs every three to four years, servers at five and firewalls at three to five.
Lifecycle management ties these together, tracking every device from purchase through secure disposal.
When a vendor relationship ends
Offboard a vendor with the same care as an employee. Before the contract ends, export your data in a usable format. Then remove the vendor’s accounts, remote access tools and shared passwords, and get written confirmation that they deleted or returned your data. Update your vendor list, and if HIPAA or the Safeguards Rule applies, file the documentation. When one of our clients’ employees leaves, we disable access the same day the client asks, and a departing vendor deserves the same speed.
If you suspect you’re paying for tools nobody uses, or can’t say which vendors can reach your systems, the list above is the place to start. Our managed IT team can help you build it and keep it current, so book a 20-minute call when you’re ready.
Sources: eCFR, 16 CFR 314.4(f), FTC Safeguards Rule, oversee service providers; eCFR, 45 CFR 164.308(b), HIPAA business associate contracts; NIST, The NIST Cybersecurity Framework (CSF) 2.0, 2024.
