Vendor & Third-Party Risk Management

The finish line

By the end of this course you can read a SOC 2 report and an ISO 27001 certificate or Statement of Applicability well enough to know what each one actually covers — and, just as importantly, what it doesn’t — tier a vendor’s risk the way AABB’s own Quality System Essentials expect, and say precisely what a Business Associate Agreement (BAA) and a vendor change notification each legally obligate the other side to do.

This course turns the scrutiny this curriculum has spent nine courses aiming inward — at Lakeshore’s own BECS (Blood Establishment Computer Software), its own quality system, its own eQMS (electronic quality-management system) — outward, onto the vendors underneath all of it. Its running example is the one vendor this curriculum has already met without naming: the device-management platform whose migration left healthcare-security-and-privacy’s own Brookfield laptop incident with a permanently unresolved encryption question. This course is where Lakeshore finally asks the question that incident raised and never got to answer: what do we actually know about this vendor’s own security posture, and what does our contract with them actually require of them?

Before you start

This course assumes the foundations and three earlier courses:

The five modules

Each module is one sitting, and each has its own finish line.

  1. Supplier qualification and risk tiering. Apply AABB’s own Quality System Essential for supplier and customer issues to a real vendor decision: which vendors need deep qualification and which don’t, and why that’s a risk-tiering question, not a one-size-fits-all checklist.
  2. Reading a SOC 2 report. Tell a Type I report from a Type II, name the five Trust Services Criteria a report can cover, and read a report’s own complementary-user-entity-controls section and bridge letter for what they actually mean for Lakeshore’s own responsibilities.
  3. Reading an ISO 27001 certificate and Statement of Applicability. Know what a certificate actually certifies (a management system, not a guarantee of zero incidents), and read a Statement of Applicability to see which Annex A control domains a vendor actually claims and which it’s excluded, with a stated reason.
  4. Business Associate Agreements. Walk the actual HIPAA text requiring a BAA’s contract terms — what it obligates a vendor to do, report, and return or destroy — using the device-management platform vendor as the concrete case.
  5. Vendor change notifications and your own change control. Place a vendor’s own change-notification and incident-reporting duties directly against Lakeshore’s own change control process, and close this course by returning, one more time, to the still-unresolved Brookfield incident with the one new lens this course adds.

A note on sources

  • AABB’s own Quality System Essentials — QSE 4, “Supplier and Customer Issues,” named and themed only (no Standards text), the same handling this curriculum gives every AABB Standard.
  • SOC 2 (AICPA’s System and Organization Controls framework) and ISO/IEC 27001 are both paid, proprietary frameworks never independently fetched or quoted in this curriculum — named and described in this course’s own words, the same paraphrase-only handling already given to ISO 31000 and ISO 19011 elsewhere.
  • 45 CFR 164.314(a) and 164.504(e) — the actual HIPAA text requiring a Business Associate Agreement’s contract terms, fetched and quoted in full, never paraphrased from memory.

Modules appear in the sidebar as they’re built.