Risks arising from vendors and business partners are assessed and managed

What an auditor asks for

An assessor samples vendors that handle in-scope data and checks that a risk review exists and that open issues were tracked.

• Vendor risk review
• Vendor issue log

Evidence ShipReady collects for CC9.2

ShipReady maps CC9.2 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• Configuration exportvendor-assurance

Common gaps

• No artifact has been collected yet — ShipReady records the CC9.2 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).
• The supporting document exists but was not reviewed in the current audit period, so the evidence has lapsed.

Related controls

• CC9.1 — Business disruption scenarios have documented mitigations and recovery options