Insights · Field note · Security assurance and compliance
Vendor security assessments that do not waste everyone’s time
Three hundred questions to every vendor assesses nothing. Proportion to consequence, read the evidence, and reserve depth for the vendors that matter.
A vendor security assessment wastes time when the same long questionnaire goes to every supplier regardless of consequence, when the answers are filed unread, and when evidence is never requested from the vendors whose failure would become the organization’s breach. It works when vendors are classified by consequence first; low-consequence vendors are screened briefly; consequential vendors are asked focused questions with evidence for each; the evidence is read and the findings recorded as conditions; and the register is reviewed as services and terms change. The output is a decision about each vendor, not a filing cabinet.
In detail
What the evidence shows.
Classify first
Which vendors hold data, access systems or deliver services whose failure would be consequential. That set is small. Everything else is screened with a short questionnaire and a check of certifications. Depth is spent where consequence is, which is what makes the depth affordable.
Ask less, read more
For consequential vendors, a focused set of questions by section, each paired with the evidence to request: the SOC 2 report, the certificate, the configuration export, the test summary, the continuity test record, the AI data-use disclosure. The assessor reads the evidence and records findings. An answer without evidence is recorded as unverified.
Decide and record
Each assessment ends in a rating, conditions the contract or the relationship should carry, and a register entry with a review date. Conditions are tracked. Sub-processor changes and term changes trigger review. The register answers the customer, auditor or regulator who asks how vendors are governed.
AI features changed the question
Many existing vendors have added AI features whose terms permit training on customer data or rely on third-party models. The assessment now asks explicitly, and the most common finding is a vendor the organization has used for years whose terms changed last quarter. The assessment questionnaire includes the section; see vendor security assessment and AI vendor and model risk review.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days