VRM (Vendor Risk Management) is the practice of identifying, assessing, and monitoring the security, privacy, and operational risk an organization inherits from its IT vendors and service providers. Gartner frames it as managing the residual risk of external providers that touch sensitive data or business processes.
What does a VRM program actually do?
A working VRM program runs intake, due diligence, contracting, and continuous monitoring across every vendor that touches sensitive data or systems.
In practice the work splits into four stages, each with its own artifact:
- Intake and tiering: rank vendors by data sensitivity so the deepest review goes to the riskiest spend
- Due diligence: send a SIG, CAIQ, or HECVAT and review the SOC 2 or ISO 27001 report
- Contracting: get security exhibits, DPA, and breach-notice clauses signed
- Continuous monitoring: re-assess on renewal, watch ratings, reconcile sub-processor changes
How is VRM different from TPRM?
VRM zooms in on the security, privacy, and operational risk a single vendor brings. TPRM stretches that lens across the full third-party chain.
The two get used interchangeably, and many programs make no real distinction. The cleaner read is that TPRM is the umbrella discipline (covering financial, regulatory, ESG, and fourth-party risk), and VRM is the IT-and-security slice most security teams own day to day. NIST SP 800-161r1 frames the broader C-SCRM picture, and EU regulations like DORA, in force since January 2025, push beyond a single-vendor view into ICT-chain mapping.
Why does VRM keep showing up in security questionnaires?
Buyers run VRM on you in real time. The questionnaire is the artifact, and the buyer is using it to decide whether you pass their vendor-risk bar.
Most VRM programs over-invest in pre-contract questionnaires and under-invest in renewal-cycle re-review. The answer that earned the contract last year is rarely what the buyer asks at renewal; by then they want incident logs, sub-processor changes, and a fresh SOC 2 Type 2.
Related terms
These adjacent terms map to the assessment artifacts and risk concepts a VRM team works with at every stage of the vendor lifecycle.
- TPRM - the broader umbrella that covers financial, regulatory, and fourth-party risk on top of VRM
- SIG - the Standard Information Gathering questionnaire most VRM teams send first
- HECVAT - the higher-education vendor questionnaire that crops up when selling to universities
- Fourth-party risk - the risk introduced by your vendors' own vendors, increasingly tracked under DORA