Agent WranglersProcessors and transfers Required
Rank vendors and check their evidence
Rank every vendor by the data and access it has, and require current security evidence for the top tier.
How to do it
Put vendors with personal data, customer data or production access in tier 1. Ask tier 1 for a SOC 2 Type II report whose period ended within the last 12 months, or a valid ISO/IEC 27001:2022 certificate. Read the exceptions in the report and the controls it says you must run yourself, the complementary user entity controls. Review each tier 1 vendor once a year. Tier 2 vendors fill in a short questionnaire once. Record the tier in the vendor register.
How to check
A script fails when a vendor that touches a data map store is not tier 1. It fails when a tier 1 vendor has no report or certificate, its report period ended over 12 months ago, or its certificate has expired. It also fails when its last review is older than 12 months.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/processors-and-transfers/vendor-tiers.