Vendor onboarding SOP template

Vendor onboarding is proportionality management: a $30/month tool should take minutes, a $50,000 contract should take diligence, and both should end up in the same register. This template gives you tiers, checks per tier, and one vendor record format — so nothing runs on an employee’s personal card and a forgotten auto-renewal never surprises you again.

Intake and tiering

One request path

Anyone proposing a new vendor files the same short request: what it does, why existing tools don’t cover it, expected monthly and annual cost, what data it will touch, and who will own the relationship. The request is two minutes of writing that prevents duplicate tools and orphaned subscriptions.

Three tiers

Tier 1 — under $100/month, no customer or employee data: ops approval, card payment, register entry; same-day. Tier 2 — up to $1,000/month or any access to internal data: adds a security questions pass and budget-owner approval. Tier 3 — above that, or any customer-data access, or contract terms beyond monthly: full review below. Tier by whichever axis is highest — a cheap tool with customer-data access is Tier 3.

Due diligence (Tier 2–3)

Security review

Proportional questions: where is data stored and processed, is it encrypted at rest and in transit, do they support SSO, what’s their breach-notification commitment, and do they hold relevant certifications (SOC 2, ISO 27001). For customer-data access, review their DPA and subprocessor list — actually read the subprocessor list; that’s where surprises live.

Business review

Confirm pricing against at least one alternative, check renewal and termination terms (auto-renewal windows especially), and identify the exit path: can you export your data, in what format, and does anything contractually survive termination?

Contract and payment setup

Capture the contract

Signed agreement, order form, and DPA live in the contract folder, linked from the vendor register. Record: renewal date, notice window for cancellation, price-increase terms, and the agreed spend. Set a reminder at renewal-minus-notice-window — this one reminder pays for the whole procedure.

Set up payment properly

Vendor goes into the AP system with payment method matching its tier — card for Tier 1, invoice terms for Tier 2–3. Banking details verified out-of-band for invoice vendors (call a known number, never trust the PDF). No vendor on personal cards past the first month, ever.

The vendor register

One row per vendor

The register holds: vendor, owner, tier, what it does, monthly/annual cost, renewal date, data access level, and contract link. Review it quarterly: unowned vendors get an owner or a cancellation; unused seats get trimmed; upcoming renewals get a keep/renegotiate/kill decision before the notice window closes.

Offboarding a vendor

When a vendor is cut: cancel per the notice terms, export any data you need, revoke their access and integrations, remove from AP, and mark the register row terminated with the date. A dead vendor with a live API key is a security finding waiting to be written up.