- [Narrator] One of the most important components
of managing vendor relationships
is ensuring that appropriate agreements
are in place to ensure interoperability
and require that the vendor provide
a level of service consistent
with the customer's expectations.
As an organization begins to evaluate
a new vendor relationship, it should establish
service-level requirements, or SLRs,
that describe the organization's expectations
of the vendor during the relationship.
These requirements may address
any concerns that the customer has
for the quality of service provided by the vendor.
For example, service-level requirements may include
system response time,
service availability,
data preservation requirements,
or any other parameter specified by the customer.
Once an organization negotiates these SLRs with the vendor,
it should document the results
in a service-level agreement, or SLA.
The SLA is a written contract between the vendor
and the customer that describes
the conditions of service and penalties the vendor
will incur for failure to maintain
the agreed upon service levels.
There are many other vehicles
available to organizations seeking
to formalize relationships with their vendors.
A memorandum of understanding or MOU
is simply a letter written to document aspects
of the relationship.
MOUs are commonly used
when a legal dispute is unlikely
but the customer and vendor
still wish to document their relationship
to avoid future misunderstandings.
MOUs are commonly used in cases
where an internal service provider
is offering a service to a customer
that is in a different business unit of the same company.
Business partnership agreements, or BPAs,
exist when two organizations agree
to do business with each other in a partnership.
For example, if two companies jointly develop
and market a product, the BPA might specify
each partner's responsibilities
and the division of profits.
Interconnection security agreements, or ISAs,
include details on the way
that two organizations will interconnect
their networks, systems, and/or data.
The ISA provides details on connection security parameters
such as the encryption standards
and transfer protocols that will be used.
Security and compliance are key issues
during the negotiation of agreements with vendors.
As the organization develops service-level requirements,
it should include its minimum security requirements
in the agreement.
For example, the customer might state
that it expects all information will be encrypted
both at rest and in transit
using AES 256-bit encryption.
As you review a proposed agreement
from a security perspective,
you should ensure that the agreement includes
appropriate provisions that protect
your organization when it comes
to both security and compliance.
The agreement should document all security
and compliance requirements and it should also
allow the customer to verify compliance
and performance standards through monitoring
conducted either by the customer
or by an independent third party.
Agreements should also ensure the right
of the customer to audit the vendor through assessments
conducted by the customer or a third party.
These assessments may include on-site visits,
the exchange and review of documents,
and the review of policies, processes, and procedures.
Contracts and agreements are an important part
of the relationship between a customer and a supplier.
Taking the time to clearly document
an agreement avoids misunderstandings
in the early stages of a relationship
and protects both parties
in the event of a dispute later on.