Key Takeaways: A vendor risk assessment checklist standardizes how you evaluate third parties, surfaces control gaps before they become incidents, and gives you defensible documentation for audits. This 50-question checklist covers access controls, data protection, security operations, incident response, compliance evidence, and fourth-party risk, grouped so you can adapt depth to vendor criticality.
This checklist is a practical companion to our broader analysis of the 2026 TPRM landscape, so you can connect the “what’s changing” to the exact questions you’ll ask vendors.
What "Vendor Risk" Really Means (in Plain English)
Vendor risk is the potential for a third party to negatively impact your organization, whether through a data breach, service outage, compliance violation, or reputational damage. Every vendor you connect to your systems, share data with, or rely on for critical operations extends your attack surface and your liability.
Here's the uncomfortable truth: your security program is only as strong as your weakest vendor. A single supplier with poor access controls or unpatched systems can become the entry point for attackers targeting your data.
That's why vendor risk management isn't just procurement paperwork. It's a security discipline that answers three questions:
- What could go wrong? (Identify risks based on data access, system integration, and service criticality)
- How likely is it? (Evaluate the vendor's controls and track record)
- What's the impact? (Determine business, regulatory, and reputational consequences)
A structured checklist ensures you ask the right questions consistently, so you're not relying on gut instinct or inconsistent tribal knowledge. For a deeper dive into building a complete third-party risk program, check out our TPRM services overview.
The 50-Question Checklist (Grouped by Risk Domain)
Use this checklist as a starting point. For critical vendors (those with access to sensitive data or production systems), work through all 50 questions. For lower-risk vendors, focus on the sections most relevant to their scope.
Access & Identity (Questions 1–10)
These questions determine whether the vendor controls who can access your data and how.
- Does the vendor enforce multi-factor authentication (MFA) for all user accounts?
- Is MFA required for privileged/admin access specifically?
- How does the vendor manage user provisioning and de-provisioning?
- Is role-based access control (RBAC) implemented?
- How frequently are user access reviews conducted?
- What is the process for revoking access when employees leave?
- Are service accounts and API keys inventoried and rotated regularly?
- Does the vendor use a privileged access management (PAM) solution?
- How are remote access connections secured (VPN, zero trust, etc.)?
- Can the vendor provide evidence of access control policies and procedures?
Data Protection (Questions 11–20)
These questions assess how the vendor protects your data at rest, in transit, and throughout its lifecycle.
- Is data encrypted at rest? What standard (e.g., AES-256)?
- Is data encrypted in transit? What protocol (e.g., TLS 1.2+)?
- Where is data physically stored (geography, cloud provider)?
- Does the vendor classify data by sensitivity level?
- What is the data retention policy, and how is data disposed of securely?
- Are backups encrypted and tested for restoration?
- Does the vendor support data portability and return upon contract termination?
- How does the vendor prevent unauthorized data exfiltration (DLP controls)?
- Are there documented procedures for handling personally identifiable information (PII)?
- Can the vendor demonstrate compliance with relevant data privacy regulations (GDPR, CCPA, HIPAA)?
Security Operations (Questions 21–30)
These questions reveal whether the vendor actively manages threats and vulnerabilities.
- Does the vendor maintain a documented vulnerability management program?
- How frequently are systems scanned for vulnerabilities?
- What is the average time to remediate critical vulnerabilities?
- Does the vendor perform penetration testing? How often?
- Can the vendor share recent penetration test executive summaries?
- Is there a security information and event management (SIEM) solution in place?
- How are security logs retained, and for how long?
- Does the vendor have 24/7 security monitoring capabilities?
- What is the patch management cadence for operating systems and applications?
- Are endpoint detection and response (EDR) tools deployed?
Incident Response & Notification (Questions 31–38)
These questions determine whether the vendor can detect, respond to, and communicate about security incidents.
- Does the vendor have a documented incident response plan?
- Has the incident response plan been tested in the last 12 months?
- What is the vendor's commitment for notifying customers of a security incident?
- Has the vendor experienced a data breach or significant security incident in the past five years?
- If yes, what remediation actions were taken?
- Does the vendor carry cyber liability insurance?
- Who is the designated incident response contact?
- Will the vendor provide post-incident reports and root cause analysis?
Compliance & Evidence (Questions 39–45)
These questions validate whether the vendor can prove their security posture with third-party evidence.
- Does the vendor hold SOC 2 Type II certification? Can they share the report?
- Does the vendor hold ISO 27001 certification?
- Are there other relevant certifications (PCI DSS, HITRUST, FedRAMP)?
- How often are external audits conducted?
- Has the vendor experienced any compliance violations or regulatory actions?
- Can the vendor provide a completed SIG, CAIQ, or equivalent questionnaire?
- Does the vendor have documented security policies available for review?
Subprocessors & Fourth-Party Risk (Questions 46–50)
These questions address the risk introduced by your vendor's vendors.
- Does the vendor use subprocessors or subcontractors to deliver services?
- What due diligence does the vendor perform on its subprocessors?
- Will the vendor notify you before engaging new subprocessors?
- Does the vendor maintain a current list of subprocessors?
- Are subprocessors contractually bound to equivalent security requirements?
How to Score Vendors (Simple Red/Yellow/Green)
Collecting answers is only half the job. You need a consistent way to translate responses into risk decisions.
Here's a straightforward scoring approach:
| Rating | Criteria | Action |
|---|---|---|
| Green | Vendor meets or exceeds requirements. Evidence is current and complete. No critical gaps. | Approve. Standard monitoring. |
| Yellow | Vendor meets most requirements but has gaps that can be remediated. Evidence is partially available. | Approve with conditions. Document remediation timeline. Increase monitoring. |
| Red | Vendor has critical gaps (e.g., no encryption, no incident response plan, recent breach with no remediation). Evidence is missing or outdated. | Do not approve: or escalate for risk acceptance by leadership with documented justification. |
Scoring tips:
- Weight questions based on your risk appetite. Access control and data encryption failures are typically more critical than documentation gaps.
- Use a simple numeric scale (1–3 or 1–5) per question if you need a quantitative score for comparison.
- Document why you assigned each rating: auditors and leadership will ask.
For organizations managing dozens or hundreds of vendors, a tiered approach saves time: reserve the full 50-question assessment for critical and high-risk vendors, and use a shorter screening questionnaire for low-risk suppliers. Learn more about building a scalable TPRM workflow.
FAQ
How often should we reassess vendors?
Critical vendors should be reassessed annually at minimum: or whenever there's a significant change (new data access, contract renewal, or a reported incident). Lower-risk vendors can follow a longer cycle (every 2–3 years).
What if a vendor refuses to answer certain questions?
A refusal is a data point. Document it, escalate to procurement and legal, and factor the lack of transparency into your risk rating. For critical vendors, this may be a deal-breaker.
Should we use a standard questionnaire like SIG or CAIQ?
Standardized questionnaires (SIG Lite, SIG Core, CAIQ) are useful because many vendors have them pre-completed. However, supplement with your own questions tailored to your environment and compliance requirements.
How do we handle vendors that are "too big to assess" (e.g., major cloud providers)?
Large providers typically publish SOC 2 reports, shared responsibility models, and compliance documentation. Review what's available, focus your assessment on your configuration and usage, and document any gaps you accept.
What's the difference between a vendor risk assessment and due diligence?
Due diligence is the upfront evaluation before signing a contract. Vendor risk assessment is an ongoing process that includes due diligence, periodic reassessment, and continuous monitoring.
Ready to Build a Scalable Vendor Risk Process?
If you're evaluating vendors with a small team, we can help you implement a practical TPRM workflow: tiering, questionnaires, evidence review, and reporting: without slowing down procurement.
