Third-Party & Vendor Risk Management

Thu, 18 Jun 2026 00:00:00 +0000

Applies to: Any small organization, nonprofit, or team that relies on outside vendors and SaaS tools — accounting software, a CRM or donor database, email and file storage, a payment processor, contractors, and the dozens of apps connected to them.
Audience: Organizations with little or no dedicated IT/security staff and a limited budget, who still need to take reasonable, defensible care of the data their vendors touch — including donor, client, member, and financial data.

Vendor Security Requirements (Send to Your Vendors)

Thu, 18 Jun 2026 00:00:00 +0000

For our clients — how to use this page (do not send this box). This is the vendor-facing companion to our Third-Party & Vendor Risk Management guide. The section below the line is written to be sent directly to a vendor that handles your data. Fill in the bracketed fields ([…]), delete this instruction box, and send it as an email, a PDF, or an attachment to a contract or statement of work. Send it to the vendors in your “crown-jewel” bucket — the ones that touch personal data, money, or your accounts. For large providers (Google, Microsoft, Stripe, etc.), expect them to answer by pointing you to their security/trust page rather than replying point by point; that’s acceptable. KilPen can help you tailor or send this.

Third-Party-Risk on KilPen Technical Services - IT with Aloha

Third-Party & Vendor Risk Management

Vendor Security Requirements (Send to Your Vendors)