Home / Knowledge hub / Security vendor assessment
Knowledge hub
Security vendor assessment
Checking a supplier's security before you trust them with your data.
What it means
A security vendor assessment is the checking you do on a supplier before you trust them with your data, your customers or your systems, and again at intervals afterwards. It asks how the vendor protects what you give them and what they will do if something goes wrong.
The work is proportionate. A tool that sees only public marketing data needs a light check. A payments provider or a platform that holds customer records needs a deeper one, with documents, answers and sometimes a call with their security team.
Why it matters
Your customers' data does not stop being your responsibility when it sits with a supplier. A breach at a vendor can still become your incident, your notification and your contract dispute. Regulators such as those behind NIS2 and DORA expect proof that you checked.
Good assessments also save time later. A recorded decision, with the evidence behind it, answers a customer's own questionnaire and gives you something to point to when a vendor has an incident. It protects you from surprises in your own audits as well.
How it shows up
Typical evidence includes a completed security questionnaire, a recent SOC 2 report or ISO 27001 certificate, a summary of a recent penetration test, a list of their own sub-suppliers, a data processing agreement, and their incident notification terms. Add the vendor to your register once it is done.
Read the evidence, not just its existence. Check the scope: a report may cover one product and not the one you use. Check dates and whether findings were fixed. Match the depth to the risk, record the decision, and set a review date. The wider practice is covered under vendor risk management.
Questions people ask
Security vendor assessment, answered
Is a vendor assessment the same as a security questionnaire?
A questionnaire is one tool inside an assessment. The assessment also includes reports, contract terms, a risk rating and a decision.
Answers on their own prove very little. Both belong in the file.
What evidence should we ask for?
A recent independent report such as SOC 2 or an ISO 27001 certificate with its scope, a pentest summary, a data processing agreement, a list of sub-processors and the incident reporting terms.
Match the list to how sensitive the data is.
How often should we reassess a vendor?
At least yearly for vendors that hold sensitive data, and sooner after an incident, a change of ownership or a change in what they do for you.
Lower-risk vendors can be checked less often.
Can a small company do this properly?
Yes, by being selective. Rank vendors by the data they touch, assess the top few in depth and keep the rest light.
A short, recorded decision is better than a long form nobody reads.
What if a vendor refuses to share documents?
Many share under an NDA. If they will not share anything, treat that as a risk and weigh it against what they hold for you.
Consider limiting the data you give them.
Sources
Where this comes from
Related
Terms that sit next to this one
Vendor risk management
Judging and monitoring the security of the suppliers your business relies on.
Security questionnaire
The list of questions a buyer's security team sends before they sign.
Fourth-party risk
The risk that comes from your suppliers' own suppliers.
SOC 2
An audit report on how well a service provider protects customer data.
Attestation letter
A short signed statement that a test was done, for customers or auditors.
What can you show your buyers?
When your own customers assess you, they ask for test evidence. We give you findings that carry the request, the response and a retest of each fix. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.