Vendor Risk readiness quiz

Do you keep an up-to-date list of the vendors and SaaS apps that touch your data or systems?

Build and maintain a vendor inventory, including the SaaS tools staff signed up for, so you know who has access to what.

Is someone clearly responsible for approving new vendors and owning the relationship?

Name an owner for vendor decisions so new suppliers are vetted, not just signed up ad hoc.

Do you assess a vendor security posture before you hand over data or access?

Run basic security due diligence before onboarding: ask for their controls, certifications and track record.

For vendors that hold sensitive data, do you review their security reports (such as SOC 2 or ISO 27001)?

Ask higher-risk vendors for a SOC 2 or ISO 27001 report and actually read it, focusing on exceptions and scope. See the SOC 2 quiz.

Do you rank vendors by risk so you spend the most effort on the ones that matter?

Tier vendors by the data and access they have, and scale your diligence to the risk instead of treating every vendor the same.

Do your vendor contracts cover security, data handling and breach notification?

Put security expectations, data-use limits and breach-notification timelines in the contract or a data processing agreement, not just a handshake.

Do you know what data each vendor can access and where it is stored, including cross-border?

Map what data each vendor holds and where; cross-border storage can trigger privacy obligations. See the privacy quiz.

Do vendors get only the access they need, with no shared or leftover admin logins?

Grant least-privilege access to vendors and avoid shared logins, so you can track and revoke it cleanly.

Do you re-check key vendors periodically rather than only at signup?

Review your important vendors on a schedule (annually or at renewal), not only when you first onboard them.

Would you find out if a vendor had a breach that affected your data?

Make sure contracts require breach notification and that you watch for vendor incidents, so you are not the last to know.

When you stop using a vendor, do you revoke their access and recover or delete your data?

Run a vendor offboarding step: revoke access, pull back or confirm deletion of your data, and close the account.

For your most critical suppliers, do you consider the vendors they rely on (fourth-party risk)?

For critical suppliers, ask who they depend on; a failure deep in the chain can still take you down.