One of the business units (ou1) within our company is in the process of establishing an encrypted communication feed with an external vendor. The vendor provided a set of requirements for the actual implementation. That ou1 is asking info sec to approve the solution without having any runbook or SoP written yet. They already explained the solution to me and it is in accordance with the vendor requirements. What is my exposure, if vendor requests an audit at a later time (By that time all documentation will be in place)?
This is most definitely something that should be outlined in the contract between your company and the vendor. Is it not possible for you to contact the vendor and discuss the question you have asked here? Because unless someone here works for, and is a party to the specific contract, I wouldn't see how anyone here could really answer the question for you without knowing the terms of the agreement.