When the Vendor Says No: Escalation, Compensating Controls and Exit

AdvancedFree5 modules · 15 lessons

About this course

A meaningful fraction of vendor and maintainer requests for a fix or a bill of materials end in silence or a plain refusal. This course teaches the advanced half of that conversation: distinguishing will not from cannot before you escalate, using the escalation paths inside your own organisation and inside the vendor's, from account management through procurement to legal as a genuine last resort, naming compensating controls honestly for what they interrupt and what they leave exposed, documenting the attempt so a refused, tracked risk sits in a materially better position than an unrecorded gap, and confronting the concentration problem when the unresponsive vendor is also hard to replace, up to the exit decision itself. It cross references critical-ict-provider-oversight for the case where the vendor sits under a heavier regulatory regime.

What you'll learn

Will Not Versus Cannot: Reading the Vendor's Actual Position

Silence, Refusal and Incapacity: Three Problems Dressed Alike
Distinguishing Will Not From Cannot Before You Escalate
Reading the Vendor's Actual Position From What It Actually Says

Escalation Paths, Yours and Theirs

Escalating Inside Your Own Organisation First
The Vendor's Own Escalation Path: Account Management to Legal
Procurement and Legal as Levers, and When to Pull Each

Compensating Controls, Named Honestly

What a Compensating Control Actually Buys You, and What It Does Not
Network, Access and Monitoring Controls as a Holding Pattern
Contractual and Insurance Levers That Are Not Fixes

01Will Not Versus Cannot: Reading the Vendor's Actual Position3 lessons

Silence, Refusal and Incapacity: Three Problems Dressed Alike
Distinguishing Will Not From Cannot Before You Escalate
Reading the Vendor's Actual Position From What It Actually Says

02Escalation Paths, Yours and Theirs3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Documenting the Attempt for Register and Auditor

Why a Documented Refusal Is a Different Risk Position Than Silence
The Evidence Trail: What to Capture at Each Step
Writing the Register Entry an Auditor Can Actually Use

The Concentration Problem and the Exit Decision

When the Unresponsive Vendor Is Also Hard to Replace
Building the Exit Case Without Precipitating a Crisis
The Exit Decision: Thresholds, Not Feelings

Escalating Inside Your Own Organisation First

The Vendor's Own Escalation Path: Account Management to Legal

Procurement and Legal as Levers, and When to Pull Each

03Compensating Controls, Named Honestly3 lessons

What a Compensating Control Actually Buys You, and What It Does Not
Network, Access and Monitoring Controls as a Holding Pattern
Contractual and Insurance Levers That Are Not Fixes

04Documenting the Attempt for Register and Auditor3 lessons

Why a Documented Refusal Is a Different Risk Position Than Silence
The Evidence Trail: What to Capture at Each Step
Writing the Register Entry an Auditor Can Actually Use

05The Concentration Problem and the Exit Decision3 lessons

When the Unresponsive Vendor Is Also Hard to Replace
Building the Exit Case Without Precipitating a Crisis
The Exit Decision: Thresholds, Not Feelings

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.