Vendor Security Assessment Checklist for Security Teams
TL;DR · the short version
A vendor security assessment reviews a third party's security posture before you trust them with data, access or a critical dependency. A useful checklist covers the areas that predict risk: data handling, access and authentication, compliance and certifications (SOC 2, ISO 27001), sub-processors and fourth-party risk, incident response, business continuity, and contractual terms. As important as the questions is tiering: crown-jewel vendors warrant deep diligence and evidence, low-risk ones only a light review.
A vendor security assessment exists to answer one question before you sign: can we trust this third party with the data, access or dependency we are about to give them? The mistake most programmes make is treating every vendor the same — burying low-risk suppliers in questionnaires while rushing the ones that actually matter. A good checklist pairs the right questions with the right tiering.
The checklist — what to review
- Data handling: what data they access, where it is stored and processed, encryption in transit and at rest, retention and deletion. For apps that plug into Microsoft Teams, see the security review a third-party tool needs before it gets Teams data.
- Access & authentication: MFA (ideally phishing-resistant), least privilege, and how your data is segregated from other customers.
- Compliance & certifications: SOC 2 Type II, ISO 27001, and any regulatory attestations relevant to your data.
- Sub-processors: who they rely on (fourth-party risk) and how they manage it.
- Incident response: breach-notification timelines and commitments, in writing.
- Business continuity: backup, disaster recovery, and resilience.
- Contract terms: security obligations, audit rights, and liability.
Ask for evidence, not assertions
For anything beyond a low-risk vendor, request independent evidence: a current SOC 2 Type II report or ISO 27001 certificate, a pen-test summary, their incident-response policy, and a sub-processor list. Self-attested questionnaire answers are a starting point; evidence is what you can actually rely on.
Even the firms that sell assurance get reached through their suppliers: the PwC data breach confirmed in October 2026 came through a vendor hosting employee learning records, and PwC’s 2023 exposure came through the MOVEit file-transfer tool. The Breach Index tracks that pattern company by company.
Tier by exposure × importance
Rank vendors on two axes: security exposure (how much sensitive data/access they have and how strong their controls are) and business importance (how badly their failure would hurt you). High-exposure, business-critical vendors get deep diligence and ongoing monitoring; low-low vendors get a light review. This focuses effort where risk actually is.
Run a structured review with the Vendor Risk tool →, see the full checklist in our third-party checklist, and the ranking method in how to rank vendor security risk.
Frequently asked questions
What should it cover? Data handling, access/authentication, compliance/certifications, sub-processors, incident response, business continuity, and contract terms — with evidence.
Same assessment for every vendor? No — tier by risk; deep diligence for high-exposure, business-critical vendors.
What evidence? SOC 2 Type II, ISO 27001, pen-test summary, policies, sub-processor list, breach-notification commitments.
How to rank? Exposure × business importance — prioritise vendors high on both.
Frequently asked questions
What questions should a CIO or CISO ask vendors before buying a cyber recovery solution?
Beyond the standard vendor-security review (data handling, access and authentication, compliance/certifications like SOC 2 Type II and ISO 27001, sub-processors, incident response, business continuity and contract terms, all backed by evidence), a cyber-recovery solution needs recovery-specific questions: what recovery-time and recovery-point objectives (RTO/RPO) can you actually meet; are backups immutable and isolated/air-gapped so ransomware cannot encrypt or delete them; how and how often is restore tested, and can you show results; is backup data encrypted in transit and at rest with customer-controlled keys; how do you detect malware or corruption in backups before restore; what incident-response and restoration support do you provide during an active attack; and how is access to the recovery environment itself protected (phishing-resistant MFA, least privilege). Ask for evidence — test reports, attestations — not just assurances, and tier the depth of diligence to how critical the solution is.
What should a vendor security assessment cover?
The core areas: data handling (what data they access, where it is stored and processed, encryption, retention and deletion); access and authentication (MFA, least privilege, how your data is segregated); compliance and certifications (SOC 2 Type II, ISO 27001, and relevant regulatory attestations); sub-processors and fourth-party risk; incident response and breach-notification timelines; business continuity and disaster recovery; and the security terms in the contract. Ask for evidence — reports, certifications, policies — not just yes/no answers.
Should every vendor get the same assessment?
No. Tier vendors by the risk they represent — the sensitivity of the data they touch, the access they have, and how critical they are to your operations. A vendor with access to customer or regulated data, or one whose outage would stop your business, warrants deep diligence and independent evidence. A low-risk vendor with no data access may need only a light-touch review. Applying the same heavy questionnaire to everyone wastes effort and slows the business.
What evidence should I ask a vendor for?
Independent attestations where possible: a current SOC 2 Type II report or ISO 27001 certificate, a penetration-test summary, their security and incident-response policies, a list of sub-processors, and breach-notification commitments in writing. Self-attested questionnaire answers are a starting point, but for higher-risk vendors you want evidence you can verify rather than assertions.
How do I rank vendors by risk?
Combine two dimensions: security exposure (how much sensitive data or access the vendor has, and how strong their controls are) and business importance (how badly an outage or breach would hurt you). A vendor that is both high-exposure and business-critical is your top priority for deep assessment and ongoing monitoring; low-low vendors can be reviewed lightly. This exposure-times-importance ranking focuses effort where it matters.