Imported from nmoralescyber/claude-skill-optimization (
skills/legal/vendor-check/SKILL.md). Install upstream withnpx skills add nmoralescyber/claude-skill-optimization --skill vendor-check. Copyright stays with the author.
Vendor Check (Legal/Contractual Paperwork Status)
Consolidated view of what's signed, missing, and expiring with a vendor across all systems.
When to use vs. operations:vendor-review
This is the most-confused vendor cluster pair. Memorize the split:
| Skill | Question it answers | Direction | Stakeholders |
|---|---|---|---|
| legal:vendor-check (this one) | "What's our LEGAL paperwork status?" | Backward-looking (what's signed) | Legal, procurement, compliance, security |
operations:vendor-review |
"SHOULD we use / continue / replace this vendor?" | Forward-looking (decision) | Ops, procurement, finance, exec |
Often used together; different outputs and stakeholders.
Boundary tie-breaker
| Prompt signal | Skill |
|---|---|
| "What's signed," "do we have a DPA," "when does X expire" | THIS skill |
| "Should we keep using X," "compare X vs Y," "is X worth it" | operations:vendor-review |
| "Audit our paperwork with X" | THIS skill |
| "Audit our usage of X" (cost/usage) | operations:vendor-review |
| "Renew X" | BOTH — this skill first (what's signed/expiring), then operations:vendor-review (should we) |
What this skill produces
1. Document inventory
Per vendor:
| Document | Status | Effective | Expiration | Notes |
|---|---|---|---|---|
| MSA | Signed / Missing / Draft | date | auto-renew or fixed | LoL terms |
| DPA | Signed / Missing | date | tied to MSA | SCCs / IDTA module |
| Sub-processor list | Current / Stale | last reviewed | refresh cadence | Notice clause? |
| SOW(s) | Per-engagement | date | end date | Active/closed |
| NDA | Signed | date | survival term | Pre/post MSA |
| BAA | Signed / N/A | date | tied to MSA | Required if PHI |
| W-9 | On file | date | annual reconfirm | — |
| COI (general liability) | Current / Stale / Expired | date | renewal date | Limits meet MSA req? |
| COI (cyber liability) | Current / Stale / Missing | date | renewal date | Min coverage flow-down |
| SOC 2 Type II report | Received | period | annual refresh | Bridge letter for gap |
| SOC 2 bridge letter | Received / Stale | date | covers audit gap | — |
| Pen-test attestation | Received / Missing | date | annual | Required for prod-access vendors |
| Vulnerability disclosure policy | On file | — | review annually | Required by some customer DPAs |
| SBOM | On file / Missing | date | per release | For software supply chain |
| Encryption attestation (TLS 1.2+, AES-256 at rest) | Received | date | annual | Cyber-insurance warranty |
| PCI-DSS AOC | Received / N/A | date | annual | If payment data |
| Security questionnaire | Completed | date | annual refresh | CAIQ / SIG / custom |
| Right-to-audit letter on file | Yes / No | — | — | Per MSA audit clause |
2. Gap analysis (tiered)
Each gap is classified by remediation urgency:
- Tier 1 — Stop-the-bus: Block further data flow until cured (e.g., DPA missing while PII flowing; BAA missing while PHI flowing; expired cyber COI on a high-risk vendor)
- Tier 2 — Cure within 30 days: Material gap but not actively leaking liability (stale SOC 2 with no bridge letter; missing pen-test attestation on prod-access vendor)
- Tier 3 — Backlog: Hygiene improvement (missing W-9 reconfirm; outdated security questionnaire by < 1 quarter)
What's missing given relationship type:
- Vendor processes personal data (any jurisdiction) → DPA required (GDPR Art. 28; CCPA service-provider terms)
- Vendor processes PR-resident PII → DPA + verify breach-notification flow-down (PR Ley 111-2005 — controller must notify DACO and affected residents; processor must notify controller without unreasonable delay)
- Vendor processes PHI → BAA (HIPAA 45 CFR 164.504(e))
- Vendor handles payment cards → PCI-DSS AOC + scope confirmation
- Vendor has admin access to production systems → Pen-test attestation + SOC 2 Type II + right-to-audit + breach-notification clause with ≤72hr SLA
- Vendor is a sub-processor under a customer DPA → 30-day customer notice obligation; sub-processor list must be public or notice list maintained
- Vendor in restricted jurisdiction (outside adequacy) → SCCs / IDTA / data transfer mechanism + transfer impact assessment
- Vendor amount > materiality threshold → Insurance COI on file (general + cyber); minimum limits per MSA
- Vendor multi-year commitment → Termination-for-convenience window confirmed
- Cyber-insurance carrier requires vendor warranties → Confirm vendor meets policy's "vendor warranty" schedule (encryption, MFA, backup, IR plan); missing = potential coverage denial
- Vendor delivers software to us → SBOM + vulnerability disclosure policy + license-compliance scan
- Vendor has access to source code → IP assignment + code-handling/destruction clause
3. Surviving obligations register
Even after termination, what survives. Track each with its specific clock:
| Obligation | Typical clock | Source |
|---|---|---|
| Confidentiality | 3–5 yr post-term (perpetual for trade secrets) | NDA / MSA confidentiality clause |
| IP licenses granted | Per license terms | MSA IP clause / SOW |
| Indemnification | Typically perpetual for IP, capped tail for breach | MSA indemnity clause |
| Limitation of liability | Survives termination | MSA LoL clause |
| Audit rights | 1–3 yr post-term tail | MSA audit clause |
| Data return | Customer choice within 30 days; destruction within 60–90 days | DPA |
| Sub-processor wind-down notification | Vendor must notify customer of sub-processor changes during wind-down | DPA |
| Breach notification | Continues for data still in possession during wind-down | DPA |
| Cyber-insurance tail | Verify vendor maintains tail coverage for claims-made policies | COI |
| Source code escrow release | If escrow agreement exists | Escrow agreement |
3a. Termination action template
For each terminated vendor, produce a dated checklist:
Day 0 (notice given): Confirm wind-down period in MSA/DPA, freeze new SOWs, notify InfoSec to revoke access on Day X.
Day 7: Send data-return-format request (CSV/JSON/parquet, encryption in transit).
Day 30: Confirm receipt of data; request destruction certificate if applicable.
Day 60: Confirm sub-processor purge; confirm vendor's sub-processors also destroy.
Day 90: Destruction certificate received and filed; close vendor in CLM with surviving-obligation watch list (NDA, IP, indemnity, audit-tail).
Year 1+: Calendar reminders for any tail clocks (audit rights, indemnification, NDA expiry).
3b. Sub-processor change protocol
When vendor announces a new sub-processor:
- Check our customer DPAs for sub-processor notice obligation (typical: 30-day prior notice with right to object).
- Push notice to affected customers within their contractual window.
- Update sub-processor list in own DPA / trust center.
- If customer objects: coordinate with vendor on alternative routing or accept termination right.
- Confirm new sub-processor meets our security baseline (encryption, location, certifications).
4. Upcoming deadlines
Forward view with owner:
- Auto-renewal notice deadlines (often 30–90 days before renewal — set calendar reminder)
- Termination-for-convenience windows
- Annual obligations: COI refresh, SOC 2 refresh, pen-test refresh, security questionnaire, sub-processor review
- Pricing review windows
- Customer DPA notice windows triggered by sub-processor changes
When to chain to other skills
- About to negotiate a new vendor agreement: chain to
legal:review-contract - Deciding renewal vs. switch: chain to
operations:vendor-review - DPA missing and vendor processes personal data: chain to
legal:legal-risk-assessmentfor the privacy exposure score - About to onboard new vendor: chain to
operations:vendor-reviewfirst (decision), then this skill (paperwork) once decided - Suspected vendor security incident: chain to
legal:legal-risk-assessment(notification clocks) andoperations:risk-assessment(containment)
Decline triggers (do NOT use this skill if)
- Question is "should we use vendor X" (decision) →
operations:vendor-review - Question is "negotiate this clause with vendor X" (redline) →
legal:review-contract - Question is "what's the legal exposure if X fails" (risk score) →
legal:legal-risk-assessment - Question is "did X have an outage last week" (operational telemetry) → ops/observability tools
Tools that should be connected for best output
- CLM (Ironclad, Spotdraft, ContractWorks, Concord) — primary source
- CRM with vendor records
- Document storage (Box, Drive, SharePoint, Egnyte) — for older agreements not yet in CLM
- Email — for vendor correspondence and informal commitments
- Procurement system (Coupa, Airbase, Ramp) — spend signal
- Security GRC (Vanta, Drata, Secureframe) — for SOC 2, pen-test, vendor-risk records
- Cyber-insurance policy on file — to confirm vendor warranty schedule
Output formats (pick based on prompt)
- Vendor snapshot — full inventory + gap analysis + upcoming deadlines
- Gap deep-dive — one missing document analyzed with remediation steps
- Renewal package — what's needed for the renewal decision
- Termination package — surviving obligations checklist if relationship ends
- Cross-vendor summary — across all vendors, where are the highest-risk gaps (prioritized by data sensitivity × access scope × paperwork gap)
- Customer-DPA flow-down audit — verify each sub-processor meets your customer DPAs' security/notice requirements