Security · Cyber Assurance · 07
Vendor security assessment
A vendor security assessment establishes whether a supplier that handles your data, connects to your systems or supports a critical process operates the controls it claims. It is needed before a new vendor is onboarded, at contract renewal, when a vendor changes ownership or platform, when a customer or regulator asks how you oversee suppliers, or after a vendor incident. The assessment produces a documented review of the vendor’s security evidence, a technical check of the integration points you actually depend on, a rating that reflects the consequence of that vendor failing, and the contractual and monitoring conditions that should apply. It replaces the questionnaire nobody reads with a judgment someone is accountable for.
Scope
What the review covers.
- Classification of the vendor by data handled, system access and process criticality
- Review of the vendor’s certifications, audit reports and security documentation
- Technical review of integration points: authentication, data transfer, access rights, logging
- Contract terms: security obligations, breach notification, audit rights, exit
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Vendor assessment report | Findings, rating and the basis for each conclusion |
| Integration review | Technical findings at each point of connection |
| Conditions and monitoring plan | What the contract and ongoing oversight should require |
| Vendor register entry | Structured record for your vendor risk program |
Prerequisites
What we need from you.
- The vendor’s security documentation and any existing questionnaire responses
- Details of the integration: data exchanged, access granted, systems connected
- The contract or draft contract and a contact at the vendor for clarifications
Related
Where this sits.
- Cyber Assurance Service
- Security Hub
- Third-party risk reviews Also
- Security evidence preparation Also
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Do you contact the vendor directly?
With your agreement, yes. Vendors generally respond better to specific technical questions than to another questionnaire.
What if the vendor refuses to share evidence?
That is itself a finding. The report records what could not be verified and what that means for the decision.
Can you assess many vendors at once?
Yes. See Third-party risk reviews for a program-level approach.