Third-Party Risk Assessment Checklist: What Vendors Hide

Context for the Assessment

You are evaluating a vendor that will handle your data or access your systems. The goal is not to find perfect security, which does not exist, but to identify specific failure modes that could impact your operations. This checklist helps you move beyond generic compliance certificates. It focuses on mechanisms that actually prevent or limit damage.

Many organisations rely on questionnaires that vendors fill out themselves. These documents often reflect aspiration rather than reality. You need to verify claims against technical evidence where possible. If a vendor cannot provide proof of a control, assume the control is absent.

Access Control and Identity

• Multi-factor authentication enforcement: Ensure MFA is mandatory for all administrative and remote access accounts, not just optional.
• Just-in-time access provisioning: Verify that privileged access is granted only for specific tasks and revoked immediately after.
• Segregation of duties: Confirm that no single individual can both create and approve high-risk changes to your environment.
• Termination process automation: Check that access rights are automatically revoked within hours of an employee leaving the vendor.
• Guest account restrictions: Ensure that external contractors cannot access production systems without explicit, time-bound approval.

Weak identity controls are the most common entry point for attackers. If a vendor shares credentials or uses weak authentication, your perimeter is effectively open. You must ensure that the vendor’s internal access policies are as strict as your own.

Data Handling and Storage

• Data classification agreement: Confirm the vendor understands the sensitivity level of the data they will process.
• Encryption at rest and in transit: Verify that data is encrypted using standard algorithms and keys are managed separately from the data.
• Data retention limits: Ensure contracts specify exact deletion timelines and methods for data no longer needed.
• Backup data exposure controls: Check that backups are encrypted and stored securely to prevent backup data exposure.
• Sub-processor visibility: Require a list of all sub-suppliers who will have access to your data.

Data often moves to environments you do not control. You must define how data is protected in those external systems. Ignoring sub-processors leaves blind spots where data can be scraped or stolen. For more on how data ends up in the wrong hands, see the guide on data scraping.

Incident Response and Reporting

• Notification timeframes: Contractually define the maximum time allowed to notify you of a suspected breach.
• Forensic cooperation clauses: Ensure the vendor must preserve logs and evidence for your investigation.
• Regular penetration testing: Require annual third-party penetration tests with remediation of critical findings.
• Business continuity plans: Verify that the vendor has tested plans to restore services after a major outage.
• Breach notification law compliance: Confirm the vendor understands and adheres to relevant breach notification laws.

A breach at a vendor is a breach at your organisation. The speed and accuracy of their response determine your liability and recovery time. Vague promises of "prompt notification" are insufficient. You need specific hours or minutes defined in the contract.

Supply Chain Depth

• Software bill of materials: Request a list of all third-party libraries and components used in their software.
• Vendor security assessments: Require proof that the vendor assesses their own suppliers for security risks.
• Open source management: Verify that the vendor patches known vulnerabilities in open-source components promptly.
• Physical security audits: If hardware is involved, ensure physical access to servers is logged and restricted.
• Credential leaks monitoring: Check if the vendor monitors for their credentials appearing in credential leaks on the dark web.

Risk extends beyond the immediate vendor. If their software uses a compromised library, your systems are at risk. This is known as supply chain depth. You must ensure the vendor manages their own suppliers with the same rigor they apply to themselves.

Contractual and Legal Alignment

• Right to audit: Reserve the right to conduct your own security audits of the vendor’s systems.
• Liability caps review: Ensure liability for data breaches is not capped at a trivial amount.
• Data ownership clarity: Explicitly state that you retain all rights to the data, including derivatives.
• Termination for security failure: Include clauses that allow immediate contract termination for severe security failures.
• Oversharing on social media risks: Ensure employees are trained not to reveal system details in public forums, as discussed in oversharing on social media.

Legal documents must reflect technical realities. If the contract does not allow you to audit the vendor, you cannot verify their security. If liability is capped, you bear the financial cost of their negligence. Align legal terms with your risk appetite.

Continuous Monitoring

• Security posture scoring: Use automated tools to monitor the vendor’s external security posture continuously.
• Change management notifications: Require advance notice of significant changes to their infrastructure or software.
• Regular review cycles: Schedule quarterly reviews of the vendor’s security performance and incident history.
• Employee training verification: Request evidence that staff receive regular security awareness training.
• Child identity theft awareness: If handling minor data, ensure strict safeguards against child identity theft are in place.

Security is not a one-time event. Vendors change their infrastructure, staff, and processes over time. A vendor that was secure at onboarding may become vulnerable later. Continuous monitoring helps you detect these changes before they result in a breach.

Key takeaways

• Vendor security is not static; initial assessments often decay without continuous monitoring.
• Contractual language regarding data ownership often conflicts with technical implementation realities.
• Sub-supplier risks are frequently invisible until a breach exposes the entire chain.

Frequently asked questions

How often should I repeat the risk assessment?

Conduct full assessments annually and perform continuous monitoring for external changes. Trigger immediate reviews after any vendor incident.

What if a vendor refuses to provide a software bill of materials?

Treat this as a high-risk finding. Without visibility into components, you cannot assess supply chain risk. Consider alternative vendors or increased monitoring.

Can I rely on ISO 27001 certification alone?

No. Certification proves a framework exists, not that it is effective. You must verify specific controls relevant to your data and access needs.

How do I handle sub-supplier risks?

Require the primary vendor to manage sub-supplier risks and provide you with a list of all entities accessing your data. Include flow-down clauses in contracts.

How this guide was produced: written by the Cipher Insider editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.