Glossary / Vendor Risk Management
Vendor Risk Management
The practice of assessing and monitoring the security and reliability risk a third-party vendor introduces, before granting access to systems or data and on an ongoing basis afterward, not just at the point of signing.
A VRM program typically tiers vendors by the sensitivity of what they can actually touch — a vendor with access to production data or systems gets more scrutiny (security questionnaires, evidence requests, sometimes an audit) than one that only handles a low-risk, low-access service, and reassessment happens periodically rather than once at onboarding.
Fourth-party risk is the layer most VRM programs underweight: a vendor's own subprocessors and vendors extend an organization's actual risk surface further than a first-party assessment reveals, and concentration risk — many of an organization's vendors quietly depending on the same underlying platform — is easy to miss without asking directly.
MSPs sit on both sides of this relationship: they're assessed as a vendor by their own clients' VRM programs (which is a meaningful part of why frameworks like SOC 2 and GLBA reach an MSP at all), and they run vendor risk management themselves over every integration and tool they connect into a client's environment.
How Nexus handles this
Nexus's own integrations follow a deliberately narrow pattern — SSRF-guarded outbound calls, secrets that are replace-only and never echoed back, and every credential-vault reveal or use logged — the kind of vendor-side discipline a client's own VRM questionnaire is usually asking about.
More terms
MSP (Managed Service Provider)
A company that remotely manages a client's IT infrastructure and end-user systems on an ongoing, proactive basis — usually a flat-fee contract, not break-fix billing.
RMM (Remote Monitoring and Management)
Software that lets an MSP monitor device health and perform remote management tasks — patching, scripting, remote control — across every client site from one console.
PSA (Professional Services Automation)
Software that runs the business side of MSP operations — ticketing, SLAs, billing, contracts, and client records — the system of record most MSP work flows through.
Ready to see it in the platform?
Join the design-partner cohort and we'll show you exactly where this lives.