Vendor Security Assessment Checklist
A vendor security assessment checklist for small teams: tier the vendor by risk, review reports and contracts, check data handling and record a clear decision.
- Typical schedule per new vendor, then annually
- The checklist 4 sections, 20 items
- Variables
{{vendor}}
Use this checklist before you sign up for a new SaaS tool, agency or contractor that will handle your company's or your customers' data, and again at each annual vendor review. It helps you decide quickly and consistently, and it leaves the record that SOC 2, ISO 27001 and GDPR processor checks expect.
Who owns it
The person who wants the vendor starts the run, because they know what data will flow there. A security or IT lead does the assessment and makes or recommends the decision. Legal or a founder reviews the contract terms for higher-risk vendors. Adapt this to your jurisdiction and contracts; it is a practical checklist, not legal advice.
Common pitfalls
- The same depth for every vendor. A font service and your payroll provider do not deserve the same review. Tier vendors by the data they get and how critical they are.
- Long questionnaires nobody reads. Ask for existing evidence first, such as a SOC 2 report or ISO 27001 certificate, and read the scope and exceptions.
- A certificate that does not cover the product. Check that the report or certificate covers the service you are buying, not just the company's head office.
- Assessment after the contract. Once the data is uploaded, your leverage is gone.
- No exit plan. Know how you get your data back and deleted before you depend on the vendor.
The checklist: Vendor security assessment: {{vendor}}
Scope and tier
-
Describe what
{{vendor}}will do and which data it will receive -
Classify the data: public, internal, confidential, personal or special category
-
Assign a risk tier based on data sensitivity and how critical the service is
Use the tier to decide how deep the rest of this review goes. Low-tier vendors may only need the first section and a decision.
-
Name the internal business owner for
{{vendor}}
Security evidence
-
Request the SOC 2 Type II report, ISO 27001 certificate or equivalent
-
Check that the report or certificate scope covers the service you will use
-
Read exceptions, qualified opinions and complementary user entity controls in the report
-
Confirm support for SSO and multi-factor authentication
-
Confirm encryption in transit and at rest
-
Ask how the vendor handles vulnerabilities and when it last had a penetration test
-
Review the vendor's security questionnaire answers for high-risk tiers optional
Data protection and contract
-
Confirm where data is stored and processed, including sub-processors
-
Sign a data processing agreement if the vendor processes personal data
-
Check breach notification terms and timelines in the contract
-
Check data return and deletion terms at the end of the contract
-
Check availability commitments and support terms for critical services optional
Decision and follow-up
-
Record the decision: approved, approved with conditions, or rejected
-
Record accepted risks with the name of the person who accepted them
-
Add
{{vendor}}to the vendor inventory with tier, owner and review date -
Configure the account securely: SSO, MFA, least-privilege roles and audit logging
Checklist as Markdown
Frequently asked questions
What should a vendor security assessment include?
At minimum: what data the vendor receives, how critical it is, what independent evidence of its security exists, and what the contract says about data protection, breaches and exit. Record the decision and who accepted any remaining risk. Deeper technical checks are worth it only for higher-risk vendors.
Is a SOC 2 report enough to approve a vendor?
It is strong evidence, but read it rather than just collecting it. Check that the scope covers the service you buy, look at any exceptions, and note the controls the vendor expects you to run yourself. You still need a suitable contract and a secure configuration on your side.
How often should vendors be reassessed?
Review high-risk vendors at least once a year and whenever their service, ownership or your use of them changes. Lower-risk vendors can be reviewed less often. A scheduled checklist per vendor tier keeps the reviews from slipping.
Updated