Vendor Risk Assessment: Process, Checklist and Questions to Ask

A vendor risk assessment checks whether a supplier that touches your data or systems is secure enough for what you plan to use it for. For a SaaS company, vendors include your cloud provider, payment processor, support desk, analytics tools and AI services. Many breaches start at a vendor, and SOC 2, ISO 27001, HIPAA and GDPR all expect you to assess suppliers. This guide explains a practical process for small teams, with a checklist and the questions to ask.

Related guides: How to review a vendor's SOC 2 report · Vendor security questionnaire template · Vendor risk management policy · Best vendor risk management software

Key takeaways

• Tier vendors by risk first. Deep reviews for critical vendors, light checks for low-risk ones.
• Start from existing assurance, such as a SOC 2 report or ISO 27001 certificate, before sending a long questionnaire.
• Put protections in the contract: security commitments, breach notification, sub-processor rules and a DPA.
• Vendor risk is not one-off. Reassess critical vendors at least yearly and monitor for changes.

---

Why vendor risk assessments matter

Every vendor with access to your data extends your attack surface. A compromised support tool can expose customer tickets, and an outage at a payment provider can stop revenue. Auditors check that you know your vendors, assess them before use, and review them regularly. Customers also ask about your vendors in security questionnaires, and GDPR requires due diligence on processors.

Step 1: tier your vendors

Tier	Criteria	Assessment depth	Review frequency
Critical	Hosts or processes customer data, or the service fails without it	SOC 2 or ISO 27001 review, questionnaire, contract and DPA review	Annually
High	Accesses confidential or personal data in limited ways	SOC 2 or ISO 27001 review, short questionnaire, DPA	Annually
Medium	Limited internal data, no customer data	Basic security check, terms review	Every two years
Low	No access to sensitive data or systems	Approval and inventory entry only	At renewal

Step 2: gather evidence

Ask for evidence in this order, stopping when you have enough for the tier:

1. Independent reports: SOC 2 Type 2 report, ISO 27001 certificate and Statement of Applicability, penetration test summary
2. Trust center: many vendors publish policies, certifications and sub-processor lists
3. Security questionnaire: a short, tier-appropriate questionnaire for gaps not covered by reports
4. Public signals: breach history, security advisories, financial stability for critical vendors

Reading a SOC 2 report well is a core skill. Check the scope, period, opinion, exceptions and complementary user entity controls. See how to review a vendor's SOC 2 report.

Step 3: ask the right questions

For critical and high-risk vendors, cover these areas:

Area	Key questions
Data	What data will you hold, where is it stored, and how is it encrypted at rest and in transit?
Access	Who at your company can access our data, with what authentication and approval?
Security program	Which certifications or audits do you hold, and when do they expire?
Vulnerability management	How often do you test and patch, and do you run penetration tests?
Incident response	How fast will you notify us of a breach affecting our data?
Sub-processors	Which sub-processors handle our data, and how will you notify changes?
Continuity	What are your recovery objectives, and when did you last test them?
AI use	Do you use our data to train AI models, and can we opt out?
Exit	How do we export our data, and how and when is it deleted after termination?

Step 4: score and decide

Rate inherent risk from the tier and residual risk after reviewing evidence. Decide to approve, approve with conditions such as enabling SSO or signing a DPA, or reject. Record the decision, the reviewer and the next review date. Accepting a risk is fine when it is documented and approved by the right person.

Step 5: put it in the contract

• Security commitments that match what the vendor told you
• Breach notification within a defined time
• A data processing agreement where personal data is involved, see DPAs under GDPR
• Sub-processor approval and notice of changes
• Right to receive updated audit reports each year
• Data return and deletion at the end of the contract
• For HIPAA, a business associate agreement

Step 6: monitor and reassess

Reassess critical vendors yearly, collect new SOC 2 reports and bridge letters, watch for breaches and acquisitions, and review access the vendor has to your systems. When a vendor's use changes, for example a new integration with production data, reassess before it goes live.

Vendor risk scoring example

Vendor	Tier	Evidence	Key findings	Decision
Cloud hosting provider	Critical	SOC 2 Type 2, ISO 27001	No exceptions; CUECs require our MFA and key management	Approve; map CUECs to our controls
Customer support platform	High	SOC 2 Type 2	One minor exception in access reviews, fixed	Approve; enable SSO; DPA signed
AI writing assistant	High	Trust center, questionnaire	Trains on customer data by default	Approve with conditions: opt out of training, no customer data in prompts
Design tool	Low	Terms review	No sensitive data	Approve; add to inventory

Assessing AI vendors

AI services raise extra questions: whether prompts and outputs are used to train models, how long data is retained, where processing happens, whether outputs can expose other customers' data, and how the vendor protects against prompt injection and misuse. Record the answers alongside the usual security review, and check that the AI governance framework approves the use case.

Vendor risk assessment checklist

• Vendor added to inventory with owner and purpose
• Data types and system access recorded
• Risk tier assigned
• SOC 2 report, ISO 27001 certificate or equivalent reviewed
• Questionnaire completed where needed
• Findings and conditions recorded
• DPA or BAA signed where required
• Contract security terms in place
• Decision approved with next review date
• Access provisioned through SSO where possible

Related guides:

• Cyber vendor risk management
• The vendor vetting playbook

How SecureSlate helps

SecureSlate vendor risk management keeps your vendor inventory, tiers, questionnaires, SOC 2 reports, DPAs and review dates in one place, and reminds owners when reassessments are due, giving auditors clean evidence for SOC 2, ISO 27001 and HIPAA.

FAQ

What is a vendor risk assessment?

It is a review of a supplier's security, privacy and operational practices to decide whether the risk of using it is acceptable and what conditions apply.

How often should vendors be assessed?

Critical and high-risk vendors at least once a year, others every one to two years or at renewal, and any vendor whenever its use or risk changes.

Is a SOC 2 report enough for a vendor assessment?

Often for medium and many high-risk vendors. For critical vendors, combine it with a short questionnaire on areas the report does not cover and a contract review.

Who should perform vendor risk assessments?

In a small company, the security or compliance lead runs the process, with the business owner of the vendor answering what it will be used for, and legal reviewing contracts.

What is the difference between vendor risk and third-party risk?

They are often used interchangeably. Third-party risk is slightly broader and can include partners, contractors and resellers as well as vendors.

---

How many vendors does a typical small SaaS company have?

Often 50 to 150 tools, but only a small share are critical or high risk. Tiering lets you focus effort on the few that matter most.

Should we assess free tools?

Yes, if staff put company or customer data into them. Free tools often have weaker data protection terms, which is a common source of data leakage.

Can we rely on a vendor's ISO 27001 certificate alone?

Check that the certificate is from an accredited body, is current, and that its scope covers the service you use. Ask for the Statement of Applicability for critical vendors.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory, or professional advice. Requirements vary by framework, industry, and jurisdiction. Consult qualified advisors for your specific obligations.