LEG-01:VM-08

High-risk vendors: invoices, contracts and SOC reports maintained

Status

No evidence

Policy cadence

Annual

Last evidence

—

Next due

—

Owner

Operations

TSC

CC9.1

Evidence folder

08_Vendor_Management

Automatable

Yes

Policy

LEG-01

Policy version

v2.0 (2026-05-28)

Collectors

Collector	Relationship	Samples	What it observes
No collector references this control yet.

Evidence satisfying this control

Collected	Collector	Result	Source	Digest
No artifact satisfies this control.

Evidenced by a person. Head of People & Ops owes this. The scheduler opens a request 30 days before it comes due; none is open right now.

Definition history

Changed	Field	From	To	Source
2026-09-10 03:32	attestation_lead_days	7	30	sync_controls
2026-09-10 03:32	attestation_instructions	—	Current SOC 2 or SOC 3 report for each high-risk vendor, wi…	sync_controls
2026-09-10 03:32	attestation_role	—	Head of People & Ops	sync_controls

A cadence change re-judges this control's existing evidence against the new interval, so its status can move the moment the change lands. That is why the change is recorded rather than just applied.