Vendor.json

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "#Vendor",
  "description": "An external organization that is a vendor or service provider.",
  "type": "object",
  "allOf": [
    {
      "$ref": "#Entity"
    },
    {
      "properties": {
        "category": {
          "description": "The category of vendor.",
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "array",
              "items": {
                "type": "string"
              }
            }
          ],
          "examples": [
            "business-operations",
            "cloud",
            "facilities",
            "finance",
            "infrastructure",
            "legal",
            "purchasing",
            "security",
            "software",
            "platform-development",
            "platform-social-media",
            "professional-services-staffing",
            "professional-services-recruiting",
            "professional-services-consulting",
            "generic-service-provider",
            "generic-subscription",
            "CSP",
            "ISP",
            "MSP",
            "MSSP",
            "IdP",
            "other"
          ]
        },
        "website": {
          "description": "The vendor's main website URL.",
          "type": "string",
          "format": "uri"
        },
        "departments": {
          "description": "List of business departments the vendor provides service for (e.g. IT, HR, Finance, Marketing, Development/Engineering, Security).",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "emailDomain": {
          "description": "The email domain for the vendor (e.g. @jupiterone.io).",
          "type": "string"
        },
        "mainContactName": {
          "description": "The vendor's point of contact person.",
          "type": "string"
        },
        "mainContactEmail": {
          "description": "Email of the vendor's point of contact person.",
          "type": "string",
          "format": "email"
        },
        "mainContactPhone": {
          "description": "Phone number of the vendor's point of contact person.",
          "type": "string"
        },
        "mainContactAddress": {
          "description": "Main physical/mailing address of the vendor.",
          "type": "string"
        },
        "mainContactTitle": {
          "description": "The title of the vendor's main point of contact. For example, 'Manager of Operations'.",
          "type": "string"
        },
        "alternateContactName": {
          "description": "The vendor's alternate/secondary point of contact person.",
          "type": "string"
        },
        "alternateContactEmail": {
          "description": "Email of the vendor's alternate/secondary point of contact person.",
          "type": "string",
          "format": "email"
        },
        "alternateContactPhone": {
          "description": "Phone number of the vendor's alternate/secondary point of contact person.",
          "type": "string"
        },
        "alternateContactAddress": {
          "description": "Alternate/secondary physical/mailing address of the vendor.",
          "type": "string"
        },
        "alternateContactTitle": {
          "description": "The title of the vendor's alternate/secondary point of contact. For example, 'CISO'.",
          "type": "string"
        },
        "admins": {
          "description": "List of admin users to the vendor account, if applicable. If this vendor account is integrated directly to JupiterOne and its data is ingested, the admin users should be already mapped as User entities.",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "breachResponseDays": {
          "description": "The number of days the vendor agrees to report an identified data breach, per vendor agreement and/or SLA. This is typically 3 to 30 days. Note that GDPR requires breach notification within 3 days / 72 hours.",
          "type": "integer"
        },
        "linkToNDA": {
          "description": "Link to Non-Disclosure Agreement (NDA) document.",
          "type": "string",
          "format": "uri"
        },
        "linkToMSA": {
          "description": "Link to Master Service Agreement (MSA) document.",
          "type": "string",
          "format": "uri"
        },
        "linkToSLA": {
          "description": "Link to Service Level Agreement (SLA) document.",
          "type": "string",
          "format": "uri"
        },
        "linkToBAA": {
          "description": "Link to Business Associate Agreement (BAA) document - for HIPAA only.",
          "type": "string",
          "format": "uri"
        },
        "linkToDPA": {
          "description": "Link to GDPR Data Processing Addendum (DPA) document - for GDPR only.",
          "type": "string",
          "format": "uri"
        },
        "linkToVTR": {
          "description": "Link to the external vendor technology risk (VTR) report.",
          "type": "string",
          "format": "uri"
        },
        "linkToISA": {
          "description": "Link to the external information security assessment (ISA) report.",
          "type": "string",
          "format": "uri"
        },
        "statusPage": {
          "description": "Link to the vendor's service status page (e.g. https://status.aws.amazon.com/).",
          "type": "string",
          "format": "uri"
        },
        "validatedOn": {
          "description": "The timestamp (in milliseconds since epoch) of when this vendor was last validated per the vendor management policy.",
          "type": "number",
          "format": "date-time"
        }
      },
      "required": ["category"],
      "excludes": ["status", "public", "temporary", "expiresOn"]
    }
  ]
}