Checklist · Operations

Vendor security onboarding

Questions and evidence to collect before a supplier gets data, access or a place in your critical path.

Owner: Procurement, security and the business ownerTime: 1 to 3 hoursISO 27001 A.5.19ISO 27001 A.5.20ISO 27001 A.5.22ISO 27001 A.5.23

0 of 20

Scope and tiering

The business owner states what the vendor will do and what data or systems they will touch.
The vendor is tiered by data sensitivity, access level and how hard they are to replace.
Higher tiers get the full review below; lower tiers get items 1 to 3 of the evidence list only.
The vendor is recorded in the supplier register with an owner and a review date.

Evidence to request

A current independent report or certificate (SOC 2 Type II, ISO 27001) with its scope matching the service you will use.
Results of a recent penetration test, or a summary with remediation status.
Security questionnaire answers for authentication, encryption, logging, and incident handling.
Business continuity and disaster recovery summary, including recovery objectives.
List of sub-processors and where data is stored and processed.
Insurance and breach history where the tier justifies it.

Contract

A data processing agreement is signed when personal data is involved.
Breach notification time is stated in hours, and who is contacted is named.
Right to audit or receive audit reports; right to be told about sub-processor changes.
Data return and deletion on exit are defined, with a deletion certificate.
Security obligations, liability and service levels are written down, not implied.

Technical onboarding

Vendor staff sign in through your identity provider with MFA, or the integration uses a scoped, rotated key.
Access is least-privilege and expires; there are no shared vendor accounts.
Network access from the vendor is restricted and logged.
Data sent to the vendor is minimised and encrypted in transit.
Review calendar set: annual for high tiers, plus on any incident, ownership change or scope change.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed. ISO references show where a list helps, not that it satisfies a control.

See these as tasks in Cisodium All checklists

Klar til å gå
forbi klassisk GRC?

14 dagers gratis prøve. Ikke noe kort. Nettskyen eller on-premises.

Bestill demo Snakk med salg →