Vendor Management Policy

1.0 — Purpose & Scope

This policy establishes Veridian Corp's requirements for identifying, assessing, onboarding, monitoring, and offboarding third-party vendors that provide products, services, or processing of Veridian data — including Protected Health Information (PHI), FDA-regulated manufacturing components, and confidential intellectual property.

All third-party relationships that involve access to Veridian data, systems, facilities, or FDA-regulated manufacturing processes must be governed by this policy without exception.

No vendor may be engaged for services affecting device safety, data security, or regulatory compliance without completion of the vendor risk assessment workflow defined in Section 4.0.

Procurement, Legal, IT Security, Regulatory Affairs, and the Data Protection Officer must collaborate on all Tier 1 and Tier 2 vendor engagements before contract signature.

2.0 — Definitions

3.0 — Vendor Risk Tier Classification Matrix

Vendor tier classification must be documented in the Vendor Risk Register within 3 business days of initial assessment and re-evaluated upon any material change to the vendor's scope of services.

Tier 1 vendors must not be downgraded to a lower tier without written approval from the CISO and VP of Regulatory Affairs.

4.0 — Vendor Onboarding Requirements

All prospective vendors must complete a Veridian information security questionnaire (Form VM-SEC-001) before contract execution.

Vendors classified as High Risk (Tier 1 or Tier 2) must provide a current SOC 2 Type II report or equivalent third-party audit (ISO 27001, ISO 13485, HITRUST) before onboarding.

A signed Non-Disclosure Agreement (NDA) must be in place before any confidential information, trade secrets, or device design data is shared with a prospective vendor.

Any vendor that will process personal data on behalf of Veridian Corp must sign a Data Processing Agreement (DPA) before any data transfer occurs.

Any vendor that will create, receive, maintain, or transmit PHI must execute a HIPAA Business Associate Agreement (BAA) before any PHI access is granted.

All vendor contracts with a value exceeding $50,000 annually must receive prior review and approval from the Legal department.

Contracts exceeding $250,000 annually or involving Tier 1 classification require Board Risk Committee notification within 10 business days of signature.

FDA-regulated component suppliers must be added to the Approved Vendor List (AVL) per SOP-PUR-003 before any purchase order affecting device manufacturing is issued.

Background checks are required for all vendor personnel who will have unsupervised physical access to Veridian facilities or production areas.

Onboarding Workflow Steps

5.0 — Due Diligence Assessment Checklist

6.0 — Approved Vendor Register (Excerpt)

Full vendor profiles with URL-embedded detail pages: Vendor Directory →

7.0 — FDA Supplier Controls (21 CFR 820.50)

Manufacturing and component suppliers for FDA-regulated devices are subject to additional quality system requirements beyond standard IT vendor due diligence.

All suppliers of components, materials, or services that affect device safety and performance must be evaluated and approved per 21 CFR 820.50 before use in production.

Supplier quality agreements must define specifications, inspection requirements, change notification obligations, and right-to-audit provisions for all Tier 1 manufacturing vendors.

Suppliers must notify Veridian within 10 business days of any change to manufacturing processes, facilities, or materials that could affect component quality.

Receiving inspection records must be maintained for all incoming components per 21 CFR 820.80; nonconforming material must be quarantined and dispositioned per SOP-QC-008.

Supplier Corrective Action Requests (SCARs) must be issued within 5 business days of identification of a supplier quality nonconformance affecting device safety.

FDA Manufacturing Supplier Map

Related: FDA Compliance Program · 21 CFR 820.50 Reference · QSR Audit Checklist (PDF)

8.0 — Ongoing Monitoring

All High Risk vendors (Tier 1 and Tier 2) must undergo an annual information security reassessment; results must be documented and retained for 3 years.

Quarterly business reviews must be conducted with all Tier 1 (critical) vendors to review performance, incidents, SLA compliance, and regulatory status.

All vendor contracts must include a clause requiring the vendor to notify Veridian Corp within 48 hours of any security incident affecting Veridian data.

The Vendor Risk Register must be updated within 5 business days of any material change to a vendor's risk profile, ownership, or service scope.

Expired SOC 2 or ISO certification reports must trigger an immediate reassessment; vendors with expired reports exceeding 90 days must be suspended from AVL pending remediation.

Continuous monitoring alerts from OneTrust Vendor Risk must be triaged by IT Security within 2 business days of receipt.

2026 Monitoring Calendar — Tier 1 Vendors

9.0 — Contract & Agreement Requirements

Contract renewal for Tier 1 vendors must include updated SOC 2 or ISO certification and a refreshed security questionnaire no older than 12 months.

Auto-renewal clauses in vendor contracts exceeding $100,000 annually require explicit opt-in approval from the CPO; silent auto-renewal is prohibited.

10.0 — Vendor Offboarding

Upon contract termination, vendors must return or provide certified destruction of all Veridian Corp data within 30 calendar days.

All vendor access to Veridian systems, networks, VPN, and physical facilities must be revoked on the final day of the contract.

A signed offboarding checklist (Form VM-OFF-001) confirming data return/destruction and access revocation must be obtained before final payment is released.

Vendor offboarding for Tier 1 vendors requires a joint exit meeting with IT Security, Legal, and the business owner within 10 business days of contract end.

Certified destruction certificates for physical or electronic media containing Confidential or PHI data must be retained for 7 years.

Offboarding Checklist (Form VM-OFF-001)

11.0 — Vendor Security Incidents

Upon notification of a vendor security incident affecting Veridian data, the Vendor Risk Team must open an incident ticket within 2 hours and classify severity per the Incident Response Plan.

Vendor incidents involving PHI must be escalated to the Data Protection Officer within 4 hours for HIPAA breach assessment.

Vendor incidents affecting FDA-regulated manufacturing data must be reported to Regulatory Affairs within 24 hours for impact assessment on device quality records.

Historical Vendor Incidents (2024–2026)

12.0 — Revision History