🔗 ~9,000 schools were breached through one vendor — none of them ran a vulnerable server. Vendor risk means owning the consequences of someone else's mistake. Three questions per vendor, honestly scored, is a working register. This tracker supports vendor-risk and GV.SC-style workflows — it is not legal advice; contract terms need your attorney.

How to use this (3 steps)

1. Duplicate this page into your workspace (top-right).
2. One copy per client. Rename it: Vendors — [Client].
3. Add a row for every vendor that touches client data, then score brutally — 🟡 means "from memory," and memory doesn't survive incidents.

Vendor Register

Contract-Clause Checklist (Q2 helper)

The afternoon drill

🐊 Vendor rows are one table. The whole posture is the product. AxiomLens runs the rest of the review — 106 controls, computed coverage, evidence tied to controls, and the board report written locally. Nothing phones home after activation. It supports compliance documentation and audit-prep workflows (it's a tool, not a certification). See it run (2 min): youtu.be/namYnNbox4k · Store: thesecuritygator.gumroad.com · Free Tuesday issue: thesecuritygator.com

Siblings: Gatorbyte #001 — the 10-missed-controls field guide · #002 — the CSF Govern tracker · #003 — the Evidence Register · #004 — the Shadow AI Starter Kit · #005 — the CaaS Pricing & Scoping Worksheet.