UBC — AI Solutions

Audit — Dynamic Documentation Platform

Living documentation that stays in sync with engineering, cloud, AI, and compliance activity. Documents update themselves as the organization changes.

Back to library

SOP

Fresh

SOP-PM-08 — Vendor & Contractor Management

Selects, contracts, onboards, and manages third-party vendors and contractors.

Owner: Procurement LeadApprover: General CounselVersion: 2.7Updated: 10/8/1969

1. Purpose

Ensure external providers meet UBC quality, security, and compliance requirements.

2. Scope

All vendors and contractors with access to UBC data, systems, or facilities.

3. Definitions

BAA — Business Associate Agreement (HIPAA).
DPA — Data Processing Agreement (GDPR).

4. Roles & Responsibilities (RACI)

Activity	R	A	C	I	Cadence
Perform due diligence	Procurement Lead	General Counsel	Security, GRC	Sponsor	Per onboarding
Sign contract & BAA/DPA	General Counsel	General Counsel	Procurement, Finance	Sponsor	Per vendor
Monitor performance	PM / Contract Owner	Procurement Lead	Quality	Sponsor	Quarterly

5. Procedure

Assess vendor risk (security, financial, compliance).
Sign MSA, SOW, BAA/DPA before any data access.
Onboard with least-privilege access and time-boxed credentials.
Monitor SLAs and quarterly performance; act on breaches per contract.
Offboard with credential revocation and data return/destruction.

6. Inputs & Outputs

Inputs

Vendor proposal
Security questionnaire
Contract terms

Outputs

Signed contracts
Vendor scorecards
Offboarding records

7. Controls & Metrics

Metric	Target
Vendors with signed BAA where required	100%
Scorecards on cadence	≥ 95%

8. Exceptions & Escalation

Emergency access for incident response requires CISO approval, 24h retro-paperwork.

9. Records & Retention

Record	Retention
Contracts	Term + 7 years
Scorecards	5 years

SOP-QMS-08
Access Control Policy
SOP-SDLC-09

11. References

ISO 9001 §8.4
SOC 2 CC9.2
HIPAA §164.308(b)

12. Revision History

See the Versions tab for the full change history maintained by the Auto-Doc Engine.

Document code: SOP-PM-08 · Aligned to ISO 9001 §8.4 / SOC 2 CC9.2. Controlled document — reproduction outside the UBC QMS requires the Quality Manager's approval.

Suggested by AI

No suggestions right now.

Frameworks

ISO 9001

SOC 2

HIPAA

GDPR