A regional credit union signs a three-year contract with a document-scanning company because it offered the lowest price and a polished demo. Eight months later the vendor's support portal is breached, and the attackers download scanned loan applications full of Social Security numbers. None of the credit union's own controls failed; it handed its members' data to a company nobody had checked.
That gap is what third-party risk management exists to close. On the CompTIA Security+ SY0-801 exam, vendor selection sits under objective 5.3, which expects you to explain how organizations assess and manage the risk that comes with vendors and partners. This lesson covers the solicitation documents that structure a purchase (RFI, EOI, RFP and RFQ), the due diligence that tests a vendor's claims, and the conflicts of interest that can quietly skew a decision.
Choosing a vendor means taking on part of its risk
When you outsource a service, you hand over the work but not the accountability. If a payroll provider leaks your employees' tax records, regulators, customers and reporters will ask what you did to check that provider before giving it the data. Privacy law makes the point directly: GDPR allows a controller to use only processors that give sufficient guarantees of appropriate security, so picking a careless vendor is a compliance failure in its own right.
Third-party risk management covers the whole vendor life cycle: selection, contracting, monitoring and exit. This lesson covers selection; agreements and ongoing monitoring follow in the next two lessons. How attackers use suppliers and service providers as a way in is covered in the threat vectors section.
Selection is the stage where you have the most leverage. A vendor competing for the business will answer questionnaires, share audit reports and accept security clauses. Once the contract is signed, every new requirement becomes a change request with a price attached.
Not every vendor needs the same scrutiny, so most programs tier vendors by risk before reviewing them. The tiering questions are simple. Will the vendor store or process sensitive data? Will it have network, remote or privileged access? Would the business stop if it failed? A cloud HR platform holding every employee's Social Security number is a top-tier vendor and gets a full review. The company that waters the lobby plants gets a basic check. Tiering is how a small team covers hundreds of vendors without either drowning in paperwork or approving everything unread.
RFI, EOI, RFP and RFQ move a purchase from questions to a price
Organizations use four kinds of solicitation documents, and each asks vendors something different. Which one fits depends on how well the buyer already understands what it needs.
A request for information (RFI) is the exploratory step. The buyer knows it has a problem but not what the market offers, so it asks vendors to describe their products, capabilities, deployment options, integrations and rough pricing. Nobody commits to anything. An RFI is also the cheapest place to screen on security: asking whether a product supports single sign-on through SAML or OpenID Connect, where customer data is hosted and whether a current SOC 2 report exists can eliminate a vendor before anyone spends weeks on it.
An expression of interest (EOI) finds out which suppliers want to take part in a planned project and are qualified to. The buyer publishes a short description of the project, and interested suppliers reply with a brief statement of interest and their qualifications, such as similar past work, certifications and capacity. The buyer uses the replies to build a shortlist for the formal request. The term is used for both the buyer's call and the supplier's reply, and some organizations call the call a request for expressions of interest. EOIs are common in government and in large projects, where an open request would draw more bids than anyone could evaluate.