Insights · Question
What should a vendor security assessment include?
Twelve things, with evidence requested in proportion to how consequential the vendor is: what services it provides and what data and systems it reaches; its security governance and named owner; certifications and attestations; identity and access controls including MFA and privileged access; data handling, encryption, residency, retention and deletion; vulnerability and patch management with timelines; monitoring and incident response with notification commitments; business continuity and tested recovery; incident history; AI features and what they do with your data; contractual commitments including audit rights and exit; and an outcome: a rating, conditions, a register entry and a review date. The questions are the easy part; reading the evidence is the assessment.
In more detail
The reasoning.
Classify vendors by consequence first. Low-consequence vendors are screened briefly; the few whose compromise would become your breach get focused questions with the artifact behind each: the SOC 2 report, the certificate, the configuration export, the test summary, the continuity test record.
AI features changed the question. Many existing vendors have added AI whose terms permit training on customer data or rely on third-party models; the assessment now asks explicitly, and the most common finding is a long-standing vendor whose terms changed last quarter.
See the vendor security assessment questionnaire, vendor security assessment and vendor security assessments that do not waste everyone’s time.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 90 days