How CUBE OneCare evaluates and governs third-party vendors — security assessments, contractual safeguards, and ongoing monitoring.
Every vendor that processes, stores, or has access to CUBE OneCare data is assessed against these criteria before onboarding.
SOC 2, ISO 27001, or equivalent certifications; penetration testing history; vulnerability management program.
Data classification awareness, encryption at rest and in transit, data minimization, purpose limitation.
Contractual retention limits, documented deletion procedures, data return on termination.
Contractual notification SLAs (72h maximum), incident response plan, root cause analysis commitment.
Least-privilege access, MFA enforcement, audit logging, employee background checks.
HIPAA Business Associate readiness, GDPR sub-processor obligations, contractual DPA coverage.
Business justification review, data flow analysis, and risk classification (Critical / High / Medium / Low).
Standardized vendor security questionnaire—covering infrastructure, access control, incident response, and compliance.
Request and review SOC 2 reports, pen test results, compliance certifications, and policy documents.
Quantitative risk scoring across 6 domains. Critical/High vendors require CISO approval.
DPA/BAA execution, data handling addendum, breach notification SLAs, liability provisions.
Annual reassessment for Critical/High vendors. Continuous monitoring for security advisories and compliance changes.
Vendor risk is not a one-time assessment. Critical and high-risk vendors are continuously monitored and reassessed annually.
| Activity | Frequency | Owner |
|---|---|---|
| Critical vendor reassessment | Annual | Security Team |
| High vendor reassessment | Annual | Security Team |
| Medium vendor reassessment | Biennial | Security Team |
| Low vendor reassessment | On renewal | Procurement |
| Security advisory monitoring | Continuous | Security Team |
| Compliance status verification | Quarterly | Compliance |
| Sub-processor change review | On change | Privacy Team |
| Contract term review | Pre-renewal | Legal |
Request our full vendor risk questionnaire template or schedule a briefing with our security team.
Disclaimer: Vendor assessment practices are maintained internally by CUBE Collective LLC. This page describes our approach to third-party risk management — not specific vendor evaluations. Vendor risk assessments are confidential. For questions about our vendor management program, use the secure compliance contact form. CUBE Collective LLC, 30 N Gould St. Ste. R, Sheridan, WY 82801, USA.