Skip to main content

V0.1 CONCEPT NOTE

The Organizational Vendor-Governance Maturity Model

Version 0.1 concept note on vendor and third-party risk governance.

All concept notesFramework library
Concept Note5 topicsVendor Governance

Topics in this research area

01
The Vendor Reassessment Lifecycle
The phases and triggers that should force a vendor review before an audit does.
→02
The Subprocessor Drift Map
Surfacing what changed beneath a vendor since the original assessment.
→03
The Fourth-Party Disposition Protocol
The decision path from detected drift to a formal disposition.
→04
The Vendor Authorization Record
Named owner, authorized scope, review date, and triggers, in one document.
→05
The Organizational Vendor-Governance Maturity Model
A diagnostic for actual vendor reassessment discipline versus stated policy.
→

v0.1 concept note. Full framework treatment forthcoming.

Disambiguation

Distinct from a TPRM maturity model in the conventional sense, which typically scores onboarding process quality. This scores ongoing coverage, the same axis the Governance Readiness Matrix scores for AI agent authorization.

A diagnostic for where an organization's actual vendor reassessment discipline sits, as distinct from where its TPRM policy documents claim it sits. Scores the gap between vendor count and vendor relationships under active, scheduled review.

Published August 2, 2026.

Published under CC BY 4.0. Free to reproduce, adapt, translate, and use commercially, including inside your own governance program, with attribution to Sougata Roy and a link to this page. Attribution is a condition of the license. Claiming authorship is not attribution. Full terms at sougataroy.com/rights

Cite this framework

Sougata Roy, "The Organizational Vendor-Governance Maturity Model", Version 0.1, August 2, 2026, https://sougataroy.com/frameworks/vendor-governance/organizational-vendor-governance-maturity-model