{"catalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","download":{"releaseId":"sha256:da173f86d3ea97c7bf983bc79a9ffbfb0beae81db545cda6eb0017a3ea6b9076","slug":"grc-vendor-due-diligence-contracting-gate","url":"/controls/assets/agent_workflow-grc-vendor-due-diligence-contracting-gate-90288617.ea1b0496ded5e488.json"},"kind":"record","record":{"attributes":{"department":"procurement","domain":"grc","lineOfDefense":"operate"},"canonicalUrl":"https://assureswarm.com/workflows/all/?w=grc-vendor-due-diligence-contracting-gate","description":"Vendor Due Diligence & Contracting Gate as a modular, decision-aware workflow. Anchor: the vendor's register entry — the Vendor item (slug: vendor). For a net-new engagement the gate creates the Vendor item and populates its tier, data_classification, business_owner, and risk_owner; for a renewal it enriches the existing Vendor item rather than duplicating it (enrich, never recreate). This is the first-line pre-contract gate the vendor-management office runs for every new engagement or renewal - tiering criticality, running proportionate due diligence into the vendor due-diligence report, documenting the risk-acceptance decision and any risk-reducing sourcing conditions, binding the contract to required security, privacy, and regulatory clauses, authorizing the specific information exchange before access begins, and - where personal data is involved - obtaining the signed written privacy commitments and scheduling compliance monitoring and incident-response routing. In scope: pre-contract due diligence, risk acceptance, and contract execution for one vendor engagement, ending with the Vendor item enrolled in monitoring (Vendor.monitoring_status = enrolled). There is no upstream workflow — the engagement trigger (a new prospective vendor or a renewal) is its own entry point. Downstream handoff: the archived gate record exported at close is the handoff package the ongoing third-party risk monitoring / vendor oversight lifecycle picks up to sustain the scheduled compliance checks and incident routing; that linkage is a prose handoff of live controls on the same Vendor item, not a triggered downstream node.","details":{"canonicalUrl":"https://assureswarm.com/workflows/all/?w=grc-vendor-due-diligence-contracting-gate","capabilities":[],"controls":["UC-TPRM-02","UC-TPRM-03","UC-DATA-16"],"domains":["grc"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:da173f86d3ea97c7bf983bc79a9ffbfb0beae81db545cda6eb0017a3ea6b9076","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:grc-vendor-due-diligence-contracting-gate","standards":["nist-800-53","soc2","nist-csf-2","gdpr"],"teams":["procurement","privacy"]},"id":"wf:G28","mapUrl":"https://assureswarm.com/controls/?v=1&node=wf%3AG28","slug":"grc-vendor-due-diligence-contracting-gate","sourceIds":["ccpa","gdpr","hipaa","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Vendor Due Diligence & Contracting Gate","type":"workflow"},"relationships":[{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:8e8c348ca31b2ccafcf8709db7835700d8d507d56d423998db579955168a3b9f","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-g28-6078329f.json","sourceId":"wf:G28","targetDetailPath":"/controls/data/v1/records/uc-uc-data-16-57ae2c9a.json","targetId":"uc:UC-DATA-16","type":"operates"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:903c9a68d6897c89dfa0bb7681b049684b8e562deb4af17c71a6544d8f58a43b","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-g28-6078329f.json","sourceId":"wf:G28","targetDetailPath":"/controls/data/v1/records/uc-uc-tprm-02-c35b26eb.json","targetId":"uc:UC-TPRM-02","type":"operates"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:d7087093aa2ac0f2a9cc70fa5acdfb27e33c2c3e142af2d8bfd87f509a2a1c2c","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-g28-6078329f.json","sourceId":"wf:G28","targetDetailPath":"/controls/data/v1/records/uc-uc-tprm-03-c9edcf93.json","targetId":"uc:UC-TPRM-03","type":"operates"}],"schemaVersion":1}