Vendor Security Assessment Checklist for Security Teams
A vendor security assessment reviews a third party's security posture before you trust them with data, access or a critical dependency. A useful checklist covers the areas that actually predict risk: data handling and where data lives, access and authentication, compliance and certifications (SOC 2, ISO 27001), sub-processors and fourth-party risk, incident-response and breach-notification commitments, business continuity, and contractual security terms. Just as important as the questions is the tiering: a vendor with access to your crown-jewel data warrants deep diligence and evidence, while a low-risk vendor may need only a light review. This checklist lays out the areas, the evidence to request, and how to rank vendors by exposure and business importance.
A vendor security assessment exists to answer one question before you sign: can we trust this third party with the data, access or dependency we are about to give them? The mistake most programmes make is treating every vendor the same — burying low-risk suppliers in questionnaires while rushing the ones that actually matter. A good checklist pairs the right questions with the right tiering.
The checklist — what to review
- Data handling: what data they access, where it is stored and processed, encryption in transit and at rest, retention and deletion.
- Access & authentication: MFA (ideally phishing-resistant), least privilege, and how your data is segregated from other customers.
- Compliance & certifications: SOC 2 Type II, ISO 27001, and any regulatory attestations relevant to your data.
- Sub-processors: who they rely on (fourth-party risk) and how they manage it.
- Incident response: breach-notification timelines and commitments, in writing.
- Business continuity: backup, disaster recovery, and resilience.
- Contract terms: security obligations, audit rights, and liability.
Ask for evidence, not assertions
For anything beyond a low-risk vendor, request independent evidence: a current SOC 2 Type II report or ISO 27001 certificate, a pen-test summary, their incident-response policy, and a sub-processor list. Self-attested questionnaire answers are a starting point; evidence is what you can actually rely on.
Tier by exposure × importance
Rank vendors on two axes: security exposure (how much sensitive data/access they have and how strong their controls are) and business importance (how badly their failure would hurt you). High-exposure, business-critical vendors get deep diligence and ongoing monitoring; low-low vendors get a light review. This focuses effort where risk actually is.
Run a structured review with the free Vendor Risk tool →, see the full checklist in our third-party checklist, and the ranking method in how to rank vendor security risk.
Frequently asked questions
What should it cover? Data handling, access/authentication, compliance/certifications, sub-processors, incident response, business continuity, and contract terms — with evidence.
Same assessment for every vendor? No — tier by risk; deep diligence for high-exposure, business-critical vendors.
What evidence? SOC 2 Type II, ISO 27001, pen-test summary, policies, sub-processor list, breach-notification commitments.
How to rank? Exposure × business importance — prioritise vendors high on both.
Ready to practise the decisions these articles describe?
Run a free War Room →