Vendor management
A vendor contact directory that survives staff turnover
How to build a shared vendor directory with roles, escalation paths, contract links, and review dates so a new IT assistant can open a case without asking around.
Start with repeatable IT work that has a clear owner, clear access limits, and a review cadence. Keep risky technical decisions with the manager or provider who owns the system.
Delegation playbook
On this pageJump to section
When a critical system fails, the first question is often who to call at the vendor and what contract covers the work. That answer usually lives in one person's inbox or memory. A vendor contact directory turns it into a shared record with roles, escalation paths, and contract references. The directory is not a CRM and does not need to be elaborate. It needs to be current enough that a new IT assistant can open a case without asking around.
What the directory is for
The directory exists to help someone open, escalate, or review a vendor case without relying on personal history. That purpose sets the fields: the product or service, the support portal, the account number, the contract owner, and the escalation contacts. A list of sales representatives is not enough. The reader needs the path they would use on a bad day, not the person who sent the last proposal or the one who appeared at the annual review.
Decide where the directory lives before adding entries. A shared document works for a small team, while a database or IT service tool works better when several people update it. Choose one location and link to it from the ticket template and the onboarding checklist. A directory that exists in three places is already out of date, and the duplication makes it harder to tell which contact was confirmed most recently.
Record the role, not just the name
Vendor contacts change more often than vendor companies do. Record the role, such as technical account manager or billing contact, beside the person's name. When the named person leaves, the role still tells the reader whom to ask for. Add the date the contact was confirmed and the source, such as a support portal or a recent email. That note helps the next reviewer judge whether the entry is trustworthy or merely familiar.
Keep personal mobile numbers out of the shared directory unless the vendor has agreed to that use. Use the published support line, the portal, and the account team's business contact. If an emergency number is necessary, restrict access and record the approval. A directory that exposes personal contact details creates a privacy problem and may discourage vendors from sharing the useful paths that make escalation work.
Capture the escalation path
Write the escalation sequence in the order the company would actually use it. Start with the support portal or first-line queue, then the account manager, then the vendor's incident process if one exists. Include the information the vendor requires at each level, such as the account number, the affected service, and the severity definition. A path without those details leads to a round of clarification while the clock runs and the user waits.
Record the company's own escalation owner as well. The directory should say who approves a paid support case, who can authorize an emergency change, and who communicates with the business. Vendor escalation fails when the internal decision maker is unknown. Naming both sides turns a contact list into a usable procedure, and it gives the assistant a clear stopping point when a decision belongs to a manager.
Keep contract and support terms beside the contact
Link each vendor entry to the contract, the support plan, and the renewal date. Note the response targets and whether they apply during business hours or around the clock. A team that expects a four-hour response from a best-effort plan will misjudge every incident. The directory should make that mismatch visible before a crisis rather than after it, when the only remaining option is an apology.
Include the termination notice period and the data return terms if they affect an exit. Those details matter when a vendor is being replaced and the team needs to keep access to records. Do not copy full contracts into the directory. Link to the controlled copy and record the owner who can answer questions about it, so the directory stays short and the legal source stays authoritative.
Review after every role change
Update the directory whenever an internal owner changes, a vendor account manager moves, or a contract renews. Add the review to the offboarding checklist and the quarterly vendor review so the update does not depend on memory. Ask the vendor to confirm the named contacts at the same time. A short confirmation email is enough to keep the entry honest, and it creates a dated record of the check.
Mark entries that could not be confirmed as unverified rather than leaving them looking current. Give the reader a date and the next action, such as a call to the account team. An unverified entry is still useful if it is labeled, because it warns the reader to check before relying on it. Silent staleness is the real problem, since it gives false confidence to someone who has never spoken to the vendor.
Test the directory with a real request
Pick a low-risk vendor question and ask someone who did not write the entry to resolve it using only the directory. Watch where they hesitate, which link fails, and which field they have to ask about. That short test finds more problems than a review meeting. Fix the entry while the experience is fresh, and record what changed so the next test can confirm the improvement.
Repeat the test after a major change, such as a portal migration or a new account team. A directory that worked last year may point to a retired portal or an old distribution list. Keep the test small and routine so it does not become a project. The measure is whether a new person can act, not whether the document looks complete, and that standard keeps the directory useful through turnover.
Sources and next step
Use the CISA Cross-Sector Cybersecurity Performance Goals and the NIST Cybersecurity Framework 2.0 as primary references for the access, asset, and recovery practices discussed in this guide. Apply your own policies, contracts, and system documentation to the workflow. Compare this guide with the shared login migration plan and the vendor contact directory guide before changing a live process.
Keep decisions, approvals, and evidence in systems the business already controls. If the coordination is recurring and your technical owner can define the boundaries, review the IT virtual assistant service areas and contact ITVirtualAssistant to discuss a limited pilot.
Operating brief
What this guide should help you decide
Routine intake, status updates, records, screenshots, and documentation upkeep.
Approvals, risky system changes, security decisions, and final technical judgment.
How to use this guide
Use this page to decide what an IT virtual assistant should handle first. If the task is recurring, documented, and easy to review, it is usually a better first delegation candidate than work that requires live technical judgment.
Treat the article as an operating brief, not just a topic overview. The goal is to turn loose IT work into a named workflow with inputs, outputs, permissions, review cadence, and a handoff rule that protects the business while reducing manager load.
Workflow
Recommended operating workflow
Define the request
Write what a vendor contact directory that survives staff turnover means in your company, where requests enter, and what finished work looks like.
Limit the access
Give the assistant only the tool permissions needed for intake, records, status updates, or documentation.
Run a pilot
Use a two-week sample period so the manager can review accuracy before expanding the workflow.
Review patterns
Summarize repeat issues, blocked requests, and escalation volume so the technical owner can improve the process.
Decision rules
| Question | VA fit signal | Escalate when |
|---|---|---|
| Is the work repeatable? | The same request appears weekly and can be described in steps. | The request changes business policy or system design. |
| Can quality be reviewed? | The manager can inspect the output without redoing the work. | Only a senior technical person can judge correctness. |
| Is access contained? | The assistant can work with read-only or role-limited access. | Admin rights, customer data, or security settings are involved. |
Delegation checklist
- Write the intake source, expected output, and manager review cadence.
- Confirm the assistant has only the permissions needed for the workflow.
- List the events that require escalation before work continues.
- Track examples for two weeks before changing the workflow.
- Save examples of good and bad outputs so the assistant has concrete references.
- Review the workflow monthly and remove permissions that are no longer needed.
Example first-week agenda
Day one should cover the workflow owner, tools, allowed actions, forbidden actions, and escalation language. By the end of week one, the assistant should have produced a small sample of completed work, a list of unclear requests, and a manager-reviewed improvement note.
What to review before delegating
Confirm the owner, access level, review cadence, and escalation path before assigning any recurring IT workflow to a remote assistant.
What should an IT virtual assistant handle first?
Start with repeatable, reviewable work such as ticket summaries, account records, documentation updates, and checklist follow up.
Get free IT support review