[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6PZZ74K3PBY9APGFCGMVJR0":3,"skill-same:01M6PZZ74K3PBY9APGFCGMVJR0":78},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":28,"commitSha":53,"skillDirectory":54,"forksCount":13,"repositoryHtmlUrl":55,"repositoryHomepageUrl":6,"ownerHtmlUrl":56,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":57,"install":58,"resources":71},"01M6PZZ74K3PBY9APGFCGMVJR0","vendor-management",null,"Implement vendor risk management programs. Assess third-party security and maintain vendor inventory. Use when managing supplier security.","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fvendor-management\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"management","vendor management","vendor","use","blob","apply","vendor risk","assess","controls","maintain","main","community","agent-skills","github","inventory","devops-security","risk","license","change","implement","2026-11-10 10:12:30",false,"---\nname: vendor-management\ndescription: Implement vendor risk management programs. Assess third-party security\n  and maintain vendor inventory. Use when managing supplier security.\ncategory: security\nrisk: safe\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Checklist and framework guidance; no privileged tooling required. Apply\n  controls through your own change process.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# Vendor Management\n\nImplement a vendor risk management program covering vendor assessment questionnaires, risk scoring, contract tracking, SLA monitoring, and ongoing oversight for compliance with SOC 2, ISO 27001, and regulatory frameworks.\n\n## Vendor Risk Tiering\n\n```yaml\nvendor_risk_tiers:\n  critical:\n    criteria:\n      - Processes or stores sensitive\u002Fregulated data (PII, PHI, PCI)\n      - Single point of failure (no alternative vendor)\n      - Has privileged access to production systems\n      - Handles authentication or security-critical functions\n    assessment_requirements:\n      - Full security questionnaire (SIG or custom)\n      - SOC 2 Type II report review (or equivalent)\n      - Penetration test results review\n      - On-site or virtual security assessment (optional)\n      - Business continuity and DR plan review\n    review_frequency: Annual\n    contract_requirements:\n      - Data processing agreement (DPA)\n      - Business associate agreement (BAA) if PHI\n      - Security SLA with breach notification timeline\n      - Right to audit clause\n      - Cyber insurance requirements\n    examples:\n      - Cloud infrastructure providers (AWS, Azure, GCP)\n      - Identity providers (Okta, Azure AD)\n      - Payment processors (Stripe, Adyen)\n      - Primary database or CRM SaaS\n\n  high:\n    criteria:\n      - Accesses significant company data (internal or confidential)\n      - Integrates with production systems via API\n      - Processes customer-facing transactions\n      - Substitution would cause significant business disruption\n    assessment_requirements:\n      - Security questionnaire\n      - SOC 2 report review (Type I or Type II)\n      - Compliance certifications verified\n    review_frequency: Annual\n    contract_requirements:\n      - Data processing agreement\n      - Security requirements appendix\n      - Incident notification clause (72 hours)\n    examples:\n      - Email\u002Fmarketing platforms (SendGrid, HubSpot)\n      - Monitoring and logging SaaS (Datadog, Splunk)\n      - CI\u002FCD platforms (GitHub, GitLab)\n      - Customer support platforms\n\n  medium:\n    criteria:\n      - Limited data access (internal data only)\n      - Non-production system integration\n      - Some business impact if unavailable\n    assessment_requirements:\n      - Abbreviated security questionnaire\n      - Compliance certification verification\n    review_frequency: Every 2 years\n    contract_requirements:\n      - Standard vendor terms with security clause\n      - NDA\n    examples:\n      - Project management tools\n      - HR platforms\n      - Travel and expense systems\n\n  low:\n    criteria:\n      - No access to company data\n      - No system integration\n      - Easily replaceable\n    assessment_requirements:\n      - Basic due diligence (public info review)\n      - Confirm no data sharing\n    review_frequency: Every 3 years or on renewal\n    contract_requirements:\n      - Standard terms\n    examples:\n      - Office supply vendors\n      - Facilities services\n      - General consulting (no data access)\n```\n\n## Vendor Assessment Questionnaire\n\n```yaml\nsecurity_questionnaire:\n  section_1_governance:\n    questions:\n      - \"Do you have a documented information security policy?\"\n      - \"Is there a designated CISO or security lead?\"\n      - \"Do you conduct annual security risk assessments?\"\n      - \"Do you have a security awareness training program?\"\n      - \"What compliance certifications do you hold? (SOC 2, ISO 27001, etc.)\"\n      - \"When was your last external security audit?\"\n      - \"Do you carry cyber liability insurance? What coverage limits?\"\n    evidence_requested:\n      - Information security policy (or summary)\n      - SOC 2 Type II report (or bridge letter)\n      - ISO 27001 certificate\n      - Cyber insurance certificate\n\n  section_2_access_control:\n    questions:\n      - \"How do you manage user access to systems containing our data?\"\n      - \"Is multi-factor authentication enforced for all personnel?\"\n      - \"How frequently do you conduct access reviews?\"\n      - \"What is your process for revoking access upon employee termination?\"\n      - \"Do you support SSO\u002FSAML integration for customer access?\"\n      - \"How do you manage privileged access?\"\n    evidence_requested:\n      - Access management policy\n      - MFA configuration documentation\n      - Access review records (sample)\n\n  section_3_data_protection:\n    questions:\n      - \"How is our data encrypted at rest?\"\n      - \"How is our data encrypted in transit?\"\n      - \"In which geographic regions is our data stored?\"\n      - \"Do you use sub-processors? If so, provide a list.\"\n      - \"What is your data retention policy?\"\n      - \"How is our data isolated from other customers? (multi-tenancy model)\"\n      - \"Can you provide data export in standard formats upon request?\"\n      - \"What is your data destruction process at contract end?\"\n    evidence_requested:\n      - Encryption standards documentation\n      - Sub-processor list\n      - Data flow diagram showing customer data handling\n\n  section_4_vulnerability_management:\n    questions:\n      - \"How frequently do you perform vulnerability scans?\"\n      - \"How frequently do you conduct penetration tests?\"\n      - \"What is your patch management SLA for critical vulnerabilities?\"\n      - \"Do you have a responsible disclosure or bug bounty program?\"\n      - \"How do you manage vulnerabilities in third-party dependencies?\"\n    evidence_requested:\n      - Penetration test executive summary (last 12 months)\n      - Vulnerability management policy\n      - Patch management SLA documentation\n\n  section_5_incident_response:\n    questions:\n      - \"Do you have a documented incident response plan?\"\n      - \"What is your breach notification timeline?\"\n      - \"Have you experienced a data breach in the last 3 years?\"\n      - \"How would you notify us in the event of a security incident?\"\n      - \"Do you conduct incident response tabletop exercises?\"\n    evidence_requested:\n      - Incident response plan summary\n      - Breach notification procedure\n\n  section_6_business_continuity:\n    questions:\n      - \"Do you have a business continuity plan?\"\n      - \"Do you have a disaster recovery plan?\"\n      - \"What are your RTO and RPO targets?\"\n      - \"How frequently do you test your DR plan?\"\n      - \"What is your uptime SLA?\"\n      - \"Do you have geographic redundancy?\"\n    evidence_requested:\n      - BCP\u002FDR plan summary\n      - Uptime SLA documentation\n      - Most recent DR test results\n\n  section_7_compliance:\n    questions:\n      - \"Do you process data subject to GDPR, HIPAA, or PCI DSS?\"\n      - \"How do you support our compliance obligations?\"\n      - \"Do you have a Data Processing Agreement (DPA) template?\"\n      - \"How do you handle data subject access requests (DSARs)?\"\n      - \"Are you FedRAMP authorized? If so, at what impact level?\"\n    evidence_requested:\n      - DPA template\n      - Compliance certification documentation\n```\n\n## Risk Scoring Model\n\n```yaml\nrisk_scoring:\n  dimensions:\n    data_sensitivity:\n      weight: 30\n      scores:\n        1: \"No access to company or customer data\"\n        2: \"Access to public or non-sensitive internal data\"\n        3: \"Access to internal confidential data\"\n        4: \"Access to PII or customer financial data\"\n        5: \"Access to regulated data (PHI, PCI, classified)\"\n\n    system_access:\n      weight: 25\n      scores:\n        1: \"No system access\"\n        2: \"Read-only access to non-production\"\n        3: \"Read\u002Fwrite access to non-production or read-only production\"\n        4: \"Read\u002Fwrite access to production systems\"\n        5: \"Privileged\u002Fadmin access to production or security systems\"\n\n    business_criticality:\n      weight: 20\n      scores:\n        1: \"No operational dependency\"\n        2: \"Minor convenience; easily replaced\"\n        3: \"Moderate dependency; replacement in weeks\"\n        4: \"Significant dependency; replacement in months\"\n        5: \"Critical dependency; no viable alternative\"\n\n    security_posture:\n      weight: 15\n      scores:\n        5: \"No certifications, no formal security program\"\n        4: \"Some security controls but no external validation\"\n        3: \"SOC 2 Type I or equivalent\"\n        2: \"SOC 2 Type II within last 12 months\"\n        1: \"Multiple certifications (SOC 2 + ISO 27001), strong program\"\n\n    regulatory_exposure:\n      weight: 10\n      scores:\n        1: \"No regulatory requirements\"\n        2: \"General data protection (GDPR basic)\"\n        3: \"Industry-specific (HIPAA, PCI)\"\n        4: \"Government (FedRAMP, ITAR)\"\n        5: \"Multiple stringent regulations\"\n\n  calculation:\n    formula: \"Sum of (dimension_score * dimension_weight) \u002F 100\"\n    risk_levels:\n      low: \"Score 1.0 - 2.0\"\n      medium: \"Score 2.1 - 3.0\"\n      high: \"Score 3.1 - 4.0\"\n      critical: \"Score 4.1 - 5.0\"\n\n  example:\n    vendor: \"Payment Processor X\"\n    data_sensitivity: 5  # PCI data\n    system_access: 4     # Production API integration\n    business_criticality: 5  # No alternative\n    security_posture: 2  # SOC 2 Type II\n    regulatory_exposure: 3   # PCI DSS\n    score: \"(5*30 + 4*25 + 5*20 + 2*15 + 3*10) \u002F 100 = 4.1 -> Critical\"\n```\n\n## Vendor Registry and Contract Tracking\n\n```yaml\nvendor_registry_schema:\n  vendor_info:\n    vendor_id: \"VND-NNNN\"\n    vendor_name: \"\"\n    vendor_website: \"\"\n    primary_contact_email: \"\"\n    security_contact_email: \"\"\n    vendor_category: \"\"  # SaaS, IaaS, Consulting, etc.\n\n  risk_assessment:\n    risk_tier: \"\"  # critical, high, medium, low\n    risk_score: 0.0\n    last_assessment_date: \"\"\n    next_assessment_date: \"\"\n    assessment_status: \"\"  # current, due, overdue\n    open_findings: 0\n    certifications:\n      - type: \"SOC 2 Type II\"\n        valid_until: \"\"\n        report_on_file: true\n      - type: \"ISO 27001\"\n        valid_until: \"\"\n        certificate_on_file: true\n\n  contract:\n    contract_id: \"\"\n    start_date: \"\"\n    end_date: \"\"\n    auto_renewal: true\n    cancellation_notice_days: 90\n    annual_value: 0\n    terms:\n      data_processing_agreement: true\n      nda: true\n      baa: false\n      right_to_audit: true\n      breach_notification_sla: \"72 hours\"\n      data_return_clause: true\n      data_destruction_clause: true\n      cyber_insurance_required: true\n\n  data_access:\n    data_types: []\n    data_classification: \"\"\n    data_location: []\n    sub_processors: []\n\n  sla_tracking:\n    uptime_sla: \"99.9%\"\n    actual_uptime_last_month: \"\"\n    support_response_sla: \"\"\n    sla_breaches_ytd: 0\n\n  status: \"\"  # active, under_review, offboarding, inactive\n  owner: \"\"   # Internal team\u002Fperson responsible\n```\n\n## SLA Monitoring\n\n```python\n\"\"\"\nVendor SLA monitoring - Track uptime and response time commitments.\n\"\"\"\nimport requests\nfrom datetime import datetime, timezone\n\n\nclass VendorSLAMonitor:\n    def __init__(self, vendors_config):\n        self.vendors = vendors_config\n\n    def check_uptime(self, vendor):\n        \"\"\"Check vendor service availability.\"\"\"\n        results = []\n        for endpoint in vendor.get(\"health_endpoints\", []):\n            try:\n                resp = requests.get(\n                    endpoint[\"url\"],\n                    timeout=endpoint.get(\"timeout\", 10),\n                    headers=endpoint.get(\"headers\", {}),\n                )\n                results.append({\n                    \"endpoint\": endpoint[\"url\"],\n                    \"status\": resp.status_code,\n                    \"response_time_ms\": resp.elapsed.total_seconds() * 1000,\n                    \"healthy\": resp.status_code == endpoint.get(\"expected_status\", 200),\n                    \"timestamp\": datetime.now(timezone.utc).isoformat(),\n                })\n            except requests.RequestException as e:\n                results.append({\n                    \"endpoint\": endpoint[\"url\"],\n                    \"status\": \"error\",\n                    \"error\": str(e),\n                    \"healthy\": False,\n                    \"timestamp\": datetime.now(timezone.utc).isoformat(),\n                })\n        return results\n\n    def check_status_page(self, vendor):\n        \"\"\"Check vendor status page for active incidents.\"\"\"\n        status_url = vendor.get(\"status_page_url\")\n        if not status_url:\n            return None\n        try:\n            api_url = f\"{status_url}\u002Fapi\u002Fv2\u002Fsummary.json\"\n            resp = requests.get(api_url, timeout=10)\n            data = resp.json()\n            return {\n                \"vendor\": vendor[\"name\"],\n                \"status\": data.get(\"status\", {}).get(\"indicator\", \"unknown\"),\n                \"active_incidents\": len(data.get(\"incidents\", [])),\n                \"components\": [\n                    {\"name\": c[\"name\"], \"status\": c[\"status\"]}\n                    for c in data.get(\"components\", [])\n                ],\n            }\n        except Exception:\n            return {\"vendor\": vendor[\"name\"], \"status\": \"unknown\"}\n\n    def generate_sla_report(self, vendor_name, monthly_checks):\n        \"\"\"Calculate monthly SLA compliance.\"\"\"\n        total = len(monthly_checks)\n        healthy = sum(1 for c in monthly_checks if c.get(\"healthy\"))\n        uptime_pct = (healthy \u002F total * 100) if total > 0 else 0\n        avg_response = (\n            sum(c.get(\"response_time_ms\", 0) for c in monthly_checks if c.get(\"healthy\"))\n            \u002F max(healthy, 1)\n        )\n        return {\n            \"vendor\": vendor_name,\n            \"period\": datetime.now(timezone.utc).strftime(\"%Y-%m\"),\n            \"total_checks\": total,\n            \"healthy_checks\": healthy,\n            \"uptime_percentage\": round(uptime_pct, 3),\n            \"avg_response_time_ms\": round(avg_response, 1),\n            \"sla_met\": uptime_pct >= 99.9,\n        }\n```\n\n\n## Contents\n\n- [Vendor Lifecycle Management](references\u002Fdetails.md)\n- [Vendor Management Checklist](references\u002Fdetails.md)\n- [Best Practices](references\u002Fdetails.md)\n\n## When to Use\n\n- Onboarding new vendors that will access company data or systems\n- Conducting annual vendor risk assessments and reassessments\n- Negotiating security requirements in vendor contracts\n- Monitoring vendor SLA compliance and security posture\n- Preparing vendor management evidence for SOC 2 or ISO 27001 audits\n\n## Limitations\n\n- Guidance and checklists only; not legal advice and not a substitute for a qualified auditor.\n- Docs-only import: upstream templates and scripts not bundled.\n\n### Example\n\n```markdown\nMap this skill's control checklist to our current evidence and list gaps.\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n","# Vendor Management\n\nImplement a vendor risk management program covering vendor assessment questionnaires, risk scoring, contract tracking, SLA monitoring, and ongoing oversight for compliance with SOC 2, ISO 27001, and regulatory frameworks.\n\n## Vendor Risk Tiering\n\n```yaml\nvendor_risk_tiers:\n  critical:\n    criteria:\n      - Processes or stores sensitive\u002Fregulated data (PII, PHI, PCI)\n      - Single point of failure (no alternative vendor)\n      - Has privileged access to production systems\n      - Handles authentication or security-critical functions\n    assessment_requirements:\n      - Full security questionnaire (SIG or custom)\n      - SOC 2 Type II report review (or equivalent)\n      - Penetration test results review\n      - On-site or virtual security assessment (optional)\n      - Business continuity and DR plan review\n    review_frequency: Annual\n    contract_requirements:\n      - Data processing agreement (DPA)\n      - Business associate agreement (BAA) if PHI\n      - Security SLA with breach notification timeline\n      - Right to audit clause\n      - Cyber insurance requirements\n    examples:\n      - Cloud infrastructure providers (AWS, Azure, GCP)\n      - Identity providers (Okta, Azure AD)\n      - Payment processors (Stripe, Adyen)\n      - Primary database or CRM SaaS\n\n  high:\n    criteria:\n      - Accesses significant company data (internal or confidential)\n      - Integrates with production systems via API\n      - Processes customer-facing transactions\n      - Substitution would cause significant business disruption\n    assessment_requirements:\n      - Security questionnaire\n      - SOC 2 report review (Type I or Type II)\n      - Compliance certifications verified\n    review_frequency: Annual\n    contract_requirements:\n      - Data processing agreement\n      - Security requirements appendix\n      - Incident notification clause (72 hours)\n    examples:\n      - Email\u002Fmarketing platforms (SendGrid, HubSpot)\n      - Monitoring and logging SaaS (Datadog, Splunk)\n      - CI\u002FCD platforms (GitHub, GitLab)\n      - Customer support platforms\n\n  medium:\n    criteria:\n      - Limited data access (internal data only)\n      - Non-production system integration\n      - Some business impact if unavailable\n    assessment_requirements:\n      - Abbreviated security questionnaire\n      - Compliance certification verification\n    review_frequency: Every 2 years\n    contract_requirements:\n      - Standard vendor terms with security clause\n      - NDA\n    examples:\n      - Project management tools\n      - HR platforms\n      - Travel and expense systems\n\n  low:\n    criteria:\n      - No access to company data\n      - No system integration\n      - Easily replaceable\n    assessment_requirements:\n      - Basic due diligence (public info review)\n      - Confirm no data sharing\n    review_frequency: Every 3 years or on renewal\n    contract_requirements:\n      - Standard terms\n    examples:\n      - Office supply vendors\n      - Facilities services\n      - General consulting (no data access)\n```\n\n## Vendor Assessment Questionnaire\n\n```yaml\nsecurity_questionnaire:\n  section_1_governance:\n    questions:\n      - \"Do you have a documented information security policy?\"\n      - \"Is there a designated CISO or security lead?\"\n      - \"Do you conduct annual security risk assessments?\"\n      - \"Do you have a security awareness training program?\"\n      - \"What compliance certifications do you hold? (SOC 2, ISO 27001, etc.)\"\n      - \"When was your last external security audit?\"\n      - \"Do you carry cyber liability insurance? What coverage limits?\"\n    evidence_requested:\n      - Information security policy (or summary)\n      - SOC 2 Type II report (or bridge letter)\n      - ISO 27001 certificate\n      - Cyber insurance certificate\n\n  section_2_access_control:\n    questions:\n      - \"How do you manage user access to systems containing our data?\"\n      - \"Is multi-factor authentication enforced for all personnel?\"\n      - \"How frequently do you conduct access reviews?\"\n      - \"What is your process for revoking access upon employee termination?\"\n      - \"Do you support SSO\u002FSAML integration for customer access?\"\n      - \"How do you manage privileged access?\"\n    evidence_requested:\n      - Access management policy\n      - MFA configuration documentation\n      - Access review records (sample)\n\n  section_3_data_protection:\n    questions:\n      - \"How is our data encrypted at rest?\"\n      - \"How is our data encrypted in transit?\"\n      - \"In which geographic regions is our data stored?\"\n      - \"Do you use sub-processors? If so, provide a list.\"\n      - \"What is your data retention policy?\"\n      - \"How is our data isolated from other customers? (multi-tenancy model)\"\n      - \"Can you provide data export in standard formats upon request?\"\n      - \"What is your data destruction process at contract end?\"\n    evidence_requested:\n      - Encryption standards documentation\n      - Sub-processor list\n      - Data flow diagram showing customer data handling\n\n  section_4_vulnerability_management:\n    questions:\n      - \"How frequently do you perform vulnerability scans?\"\n      - \"How frequently do you conduct penetration tests?\"\n      - \"What is your patch management SLA for critical vulnerabilities?\"\n      - \"Do you have a responsible disclosure or bug bounty program?\"\n      - \"How do you manage vulnerabilities in third-party dependencies?\"\n    evidence_requested:\n      - Penetration test executive summary (last 12 months)\n      - Vulnerability management policy\n      - Patch management SLA documentation\n\n  section_5_incident_response:\n    questions:\n      - \"Do you have a documented incident response plan?\"\n      - \"What is your breach notification timeline?\"\n      - \"Have you experienced a data breach in the last 3 years?\"\n      - \"How would you notify us in the event of a security incident?\"\n      - \"Do you conduct incident response tabletop exercises?\"\n    evidence_requested:\n      - Incident response plan summary\n      - Breach notification procedure\n\n  section_6_business_continuity:\n    questions:\n      - \"Do you have a business continuity plan?\"\n      - \"Do you have a disaster recovery plan?\"\n      - \"What are your RTO and RPO targets?\"\n      - \"How frequently do you test your DR plan?\"\n      - \"What is your uptime SLA?\"\n      - \"Do you have geographic redundancy?\"\n    evidence_requested:\n      - BCP\u002FDR plan summary\n      - Uptime SLA documentation\n      - Most recent DR test results\n\n  section_7_compliance:\n    questions:\n      - \"Do you process data subject to GDPR, HIPAA, or PCI DSS?\"\n      - \"How do you support our compliance obligations?\"\n      - \"Do you have a Data Processing Agreement (DPA) template?\"\n      - \"How do you handle data subject access requests (DSARs)?\"\n      - \"Are you FedRAMP authorized? If so, at what impact level?\"\n    evidence_requested:\n      - DPA template\n      - Compliance certification documentation\n```\n\n## Risk Scoring Model\n\n```yaml\nrisk_scoring:\n  dimensions:\n    data_sensitivity:\n      weight: 30\n      scores:\n        1: \"No access to company or customer data\"\n        2: \"Access to public or non-sensitive internal data\"\n        3: \"Access to internal confidential data\"\n        4: \"Access to PII or customer financial data\"\n        5: \"Access to regulated data (PHI, PCI, classified)\"\n\n    system_access:\n      weight: 25\n      scores:\n        1: \"No system access\"\n        2: \"Read-only access to non-production\"\n        3: \"Read\u002Fwrite access to non-production or read-only production\"\n        4: \"Read\u002Fwrite access to production systems\"\n        5: \"Privileged\u002Fadmin access to production or security systems\"\n\n    business_criticality:\n      weight: 20\n      scores:\n        1: \"No operational dependency\"\n        2: \"Minor convenience; easily replaced\"\n        3: \"Moderate dependency; replacement in weeks\"\n        4: \"Significant dependency; replacement in months\"\n        5: \"Critical dependency; no viable alternative\"\n\n    security_posture:\n      weight: 15\n      scores:\n        5: \"No certifications, no formal security program\"\n        4: \"Some security controls but no external validation\"\n        3: \"SOC 2 Type I or equivalent\"\n        2: \"SOC 2 Type II within last 12 months\"\n        1: \"Multiple certifications (SOC 2 + ISO 27001), strong program\"\n\n    regulatory_exposure:\n      weight: 10\n      scores:\n        1: \"No regulatory requirements\"\n        2: \"General data protection (GDPR basic)\"\n        3: \"Industry-specific (HIPAA, PCI)\"\n        4: \"Government (FedRAMP, ITAR)\"\n        5: \"Multiple stringent regulations\"\n\n  calculation:\n    formula: \"Sum of (dimension_score * dimension_weight) \u002F 100\"\n    risk_levels:\n      low: \"Score 1.0 - 2.0\"\n      medium: \"Score 2.1 - 3.0\"\n      high: \"Score 3.1 - 4.0\"\n      critical: \"Score 4.1 - 5.0\"\n\n  example:\n    vendor: \"Payment Processor X\"\n    data_sensitivity: 5  # PCI data\n    system_access: 4     # Production API integration\n    business_criticality: 5  # No alternative\n    security_posture: 2  # SOC 2 Type II\n    regulatory_exposure: 3   # PCI DSS\n    score: \"(5*30 + 4*25 + 5*20 + 2*15 + 3*10) \u002F 100 = 4.1 -> Critical\"\n```\n\n## Vendor Registry and Contract Tracking\n\n```yaml\nvendor_registry_schema:\n  vendor_info:\n    vendor_id: \"VND-NNNN\"\n    vendor_name: \"\"\n    vendor_website: \"\"\n    primary_contact_email: \"\"\n    security_contact_email: \"\"\n    vendor_category: \"\"  # SaaS, IaaS, Consulting, etc.\n\n  risk_assessment:\n    risk_tier: \"\"  # critical, high, medium, low\n    risk_score: 0.0\n    last_assessment_date: \"\"\n    next_assessment_date: \"\"\n    assessment_status: \"\"  # current, due, overdue\n    open_findings: 0\n    certifications:\n      - type: \"SOC 2 Type II\"\n        valid_until: \"\"\n        report_on_file: true\n      - type: \"ISO 27001\"\n        valid_until: \"\"\n        certificate_on_file: true\n\n  contract:\n    contract_id: \"\"\n    start_date: \"\"\n    end_date: \"\"\n    auto_renewal: true\n    cancellation_notice_days: 90\n    annual_value: 0\n    terms:\n      data_processing_agreement: true\n      nda: true\n      baa: false\n      right_to_audit: true\n      breach_notification_sla: \"72 hours\"\n      data_return_clause: true\n      data_destruction_clause: true\n      cyber_insurance_required: true\n\n  data_access:\n    data_types: []\n    data_classification: \"\"\n    data_location: []\n    sub_processors: []\n\n  sla_tracking:\n    uptime_sla: \"99.9%\"\n    actual_uptime_last_month: \"\"\n    support_response_sla: \"\"\n    sla_breaches_ytd: 0\n\n  status: \"\"  # active, under_review, offboarding, inactive\n  owner: \"\"   # Internal team\u002Fperson responsible\n```\n\n## SLA Monitoring\n\n```python\n\"\"\"\nVendor SLA monitoring - Track uptime and response time commitments.\n\"\"\"\nimport requests\nfrom datetime import datetime, timezone\n\n\nclass VendorSLAMonitor:\n    def __init__(self, vendors_config):\n        self.vendors = vendors_config\n\n    def check_uptime(self, vendor):\n        \"\"\"Check vendor service availability.\"\"\"\n        results = []\n        for endpoint in vendor.get(\"health_endpoints\", []):\n            try:\n                resp = requests.get(\n                    endpoint[\"url\"],\n                    timeout=endpoint.get(\"timeout\", 10),\n                    headers=endpoint.get(\"headers\", {}),\n                )\n                results.append({\n                    \"endpoint\": endpoint[\"url\"],\n                    \"status\": resp.status_code,\n                    \"response_time_ms\": resp.elapsed.total_seconds() * 1000,\n                    \"healthy\": resp.status_code == endpoint.get(\"expected_status\", 200),\n                    \"timestamp\": datetime.now(timezone.utc).isoformat(),\n                })\n            except requests.RequestException as e:\n                results.append({\n                    \"endpoint\": endpoint[\"url\"],\n                    \"status\": \"error\",\n                    \"error\": str(e),\n                    \"healthy\": False,\n                    \"timestamp\": datetime.now(timezone.utc).isoformat(),\n                })\n        return results\n\n    def check_status_page(self, vendor):\n        \"\"\"Check vendor status page for active incidents.\"\"\"\n        status_url = vendor.get(\"status_page_url\")\n        if not status_url:\n            return None\n        try:\n            api_url = f\"{status_url}\u002Fapi\u002Fv2\u002Fsummary.json\"\n            resp = requests.get(api_url, timeout=10)\n            data = resp.json()\n            return {\n                \"vendor\": vendor[\"name\"],\n                \"status\": data.get(\"status\", {}).get(\"indicator\", \"unknown\"),\n                \"active_incidents\": len(data.get(\"incidents\", [])),\n                \"components\": [\n                    {\"name\": c[\"name\"], \"status\": c[\"status\"]}\n                    for c in data.get(\"components\", [])\n                ],\n            }\n        except Exception:\n            return {\"vendor\": vendor[\"name\"], \"status\": \"unknown\"}\n\n    def generate_sla_report(self, vendor_name, monthly_checks):\n        \"\"\"Calculate monthly SLA compliance.\"\"\"\n        total = len(monthly_checks)\n        healthy = sum(1 for c in monthly_checks if c.get(\"healthy\"))\n        uptime_pct = (healthy \u002F total * 100) if total > 0 else 0\n        avg_response = (\n            sum(c.get(\"response_time_ms\", 0) for c in monthly_checks if c.get(\"healthy\"))\n            \u002F max(healthy, 1)\n        )\n        return {\n            \"vendor\": vendor_name,\n            \"period\": datetime.now(timezone.utc).strftime(\"%Y-%m\"),\n            \"total_checks\": total,\n            \"healthy_checks\": healthy,\n            \"uptime_percentage\": round(uptime_pct, 3),\n            \"avg_response_time_ms\": round(avg_response, 1),\n            \"sla_met\": uptime_pct >= 99.9,\n        }\n```\n\n\n## Contents\n\n- [Vendor Lifecycle Management](references\u002Fdetails.md)\n- [Vendor Management Checklist](references\u002Fdetails.md)\n- [Best Practices](references\u002Fdetails.md)\n\n## When to Use\n\n- Onboarding new vendors that will access company data or systems\n- Conducting annual vendor risk assessments and reassessments\n- Negotiating security requirements in vendor contracts\n- Monitoring vendor SLA compliance and security posture\n- Preparing vendor management evidence for SOC 2 or ISO 27001 audits\n\n## Limitations\n\n- Guidance and checklists only; not legal advice and not a substitute for a qualified auditor.\n- Docs-only import: upstream templates and scripts not bundled.\n\n### Example\n\n```markdown\nMap this skill's control checklist to our current evidence and list gaps.\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n",{"name":5,"risk":43,"source":44,"license":14,"category":45,"metadata":46,"date_added":49,"description":7,"source_repo":50,"source_type":29,"compatibility":51,"license_source":52},"safe","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills","security",{"author":47,"version":48},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Checklist and framework guidance; no privileged tooling required. Apply controls through your own change process.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Fvendor-management","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill vendor-management",{"tool":64,"command":65},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill vendor-management",{"tool":67,"command":68},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill vendor-management","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fvendor-management\u002FSKILL.md",true,[72],{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"references\u002Fdetails.md","REFERENCE","参考文档",4206,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fvendor-management\u002Freferences\u002Fdetails.md",[79,107,131,152,180,204],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":90,"publishedAt":38},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[85],{"categoryNo":86,"categoryName":87,"taxonomyType":88,"taxonomyTypeDesc":89},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[91,92,93,94,95,96,81,97,33,98,99,100,29,28,101,102,103,104,105,106],"ZeRO","trust","zero trust","architecture","assessment","verification","segmentation","access","configure","only","active","critical","scope","scripts","relevant","implementing",{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":38},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[114,115,116,117,118,119,120,121,122,123,124,125,126,100,127,29,128,129,102,130],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":137,"publishedAt":38},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[138,139,140,43,31,141,142,35,143,144,145,146,147,29,28,148,149,150,151,22],"transcript","youtube transcript","youtube","codex","research","https","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":169,"publishedAt":38},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[158,161,164],{"categoryNo":159,"categoryName":160,"taxonomyType":88,"taxonomyTypeDesc":89},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":162,"categoryName":163,"taxonomyType":88,"taxonomyTypeDesc":89},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":165,"categoryName":166,"taxonomyType":167,"taxonomyTypeDesc":168},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[138,139,140,170,43,171,31,141,35,172,173,174,175,145,176,29,28,177,178,179],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":190,"publishedAt":38},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[186,189],{"categoryNo":187,"categoryName":188,"taxonomyType":88,"taxonomyTypeDesc":89},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":162,"categoryName":163,"taxonomyType":88,"taxonomyTypeDesc":89},[140,191,192,118,43,193,194,195,196,35,174,197,198,199,200,28,201,148,202,203],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":211,"publishedAt":38},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[210],{"categoryNo":159,"categoryName":160,"taxonomyType":88,"taxonomyTypeDesc":89},[212,140,213,214,43,171,172,215,216,173,174,175,145,217,176,29,28,177,218,151],"youtube full","full","google","server","dlp","credits","automatic"]