Spokane and the Inland Northwest have a growing base of regulated small and mid-sized businesses — healthcare practices, financial services firms, and manufacturers feeding into larger supply chains like the Kaiser Aluminum and Wagstaff ecosystems. Many of these businesses have gotten diligent about their own compliance obligations. Far fewer have applied the same scrutiny to the vendors sitting inside their network.

The most common gap: no formal vendor risk review at all. A practice will spend real effort on its own HIPAA risk assessment, then hand PHI to a billing vendor, an IT provider, or a cloud backup service without ever confirming that vendor has a signed Business Associate Agreement, let alone asking what security controls that vendor actually runs internally.

Vendor concentration is a second, quieter risk. Many Spokane-area SMBs rely on a single local IT provider for everything — helpdesk, backups, security monitoring, and compliance advisory — without a clear picture of what happens if that provider has an outage, a security incident of its own, or simply goes out of business. This isn't an argument against using a local MSP; it's an argument for understanding exactly what redundancy and documentation exists if that relationship ever breaks down.

Manufacturing suppliers face a specific and growing version of this problem. Businesses in the aerospace and defense supply chain around Spokane Valley are increasingly asked by prime contractors to demonstrate specific security controls — and that requirement flows down through IT vendors too. A manufacturer that hasn't asked its IT provider what CMMC-adjacent controls are already in place may find itself scrambling when a prime contractor's next audit cycle asks the question directly.

Financial services firms often underestimate GLBA's reach into vendor management. The Gramm-Leach-Bliley Act's Safeguards Rule explicitly requires oversight of service provider security, not just internal controls. A financial advisory firm that has a strong internal password policy but has never asked its cloud file-sharing vendor about its own security practices has a real gap examiners are trained to look for.

What a reasonable vendor risk review actually looks like, at SMB scale: It doesn't need to be a formal enterprise vendor risk management program. It needs three things: a list of every vendor that touches sensitive data, a signed BAA or equivalent data protection agreement with each one, and a basic understanding of what happens — operationally and contractually — if that vendor has an incident.

Spokane's regulated SMB community is small enough that reputational risk compounds quickly. A single client of a vendor with a mishandled incident becomes a story the whole business community hears about. Getting vendor risk reviews right isn't just a compliance checkbox — locally, it's part of how trust gets built or lost.