Vendor Security Assessment: How to Vet Suppliers Before They Become Your Security Risk

You invested in a good firewall, trained your team on phishing, and enforced MFA. Then you handed your client data to a bookkeeper, a cloud software vendor, a marketing agency, and a managed print company without asking any of them a single security question. Every one of those relationships is a door into your business, and a vendor security assessment is how you find out whether it is locked before you sign, rather than after a breach. This guide, rebuilt for 2026 from a short 2026 article, explains what to ask, what evidence to require, how to score the answers, and which contract terms turn “trust me” into “show me.”

This article covers the evaluation of an individual vendor, before and during the relationship. For the ongoing program that manages all of your vendors together, see our companion guide to supply chain security for small business.

Why a Vendor Security Assessment Matters

Attackers know it is easier to breach a small, lightly defended vendor than a fortified target, and then use the vendor’s trusted access as a springboard. The SolarWinds compromise demonstrated the pattern at national scale; locally, it looks like a compromised accountant’s mailbox redirecting a client’s payment, or a software vendor’s support credentials used to plant ransomware. In each case the victim’s own defenses were irrelevant because the attack arrived through someone they trusted.

Third-party risk management has become a formal expectation rather than a best practice. The FTC Safeguards Rule requires covered businesses to select service providers capable of protecting customer information and to assess them periodically. HIPAA requires Business Associate Agreements and makes the practice responsible for what its associates do with patient data. Cyber insurance applications ask how vendors are vetted. A documented vendor security assessment is the evidence all of them want, and it is also simply how you avoid cleaning up someone else’s security failure.

When to Run a Vendor Security Assessment

• Before signing any contract with a vendor that will access your systems, hold your data, or connect to your network.
• Before granting access to an existing vendor whose role is expanding.
• Annually for critical vendors, and at renewal for important ones.
• After a reported incident at the vendor, or a significant change such as an acquisition or a move to a new platform.
• Retroactively for vendors already in place that were never assessed, starting with those holding regulated data.

Scale the depth of the vendor security assessment to the risk. A vendor with administrative access to your Microsoft 365 tenant gets the full treatment; the office coffee service does not. Our supply chain security guide explains the critical, important, and routine tiering that sets the depth.

The Vendor Risk Questionnaire: What to Ask

The vendor risk questionnaire is the core of the vendor security assessment, and it does not need to be a 300-item spreadsheet to be effective. For a small business, the questions below cover what matters. Group them by topic and require evidence, not just answers, for critical vendors.

Governance and certifications

• Do you hold a current SOC 2 Type II report, ISO 27001 certificate, or HITRUST certification? Please provide the report, including scope and exceptions, under NDA.
• Who is responsible for information security in your organization, and do you have a written security program?
• Do you carry cyber liability insurance, and at what limits?

Data handling

• What data of ours will you store, process, or transmit, and where geographically?
• Is our data encrypted in transit and at rest? With what standards and who manages the keys?
• Is our data segregated from other customers’ data?
• How long do you retain our data, and how is it securely deleted when the relationship ends?
• Which subprocessors or subcontractors will handle our data, and how do you assess them?

Access and authentication

• Is multi-factor authentication enforced for all of your employees, including administrators and remote access?
• How do you control which of your staff can access our data, and how quickly is access removed when they leave?
• Do you support single sign-on, MFA, and role-based access for our users of your platform?
• What access will you need to our systems, and can it be named, limited, and time-bound?

Security operations

• Do you perform regular vulnerability scanning and at least annual penetration testing? Can you share a summary of the latest results?
• How quickly do you apply critical security patches?
• Do you have endpoint detection and response and 24/7 security monitoring?
• How do you train your employees on security, and how often?

Incident response and continuity

• Do you have a written incident response plan, and when was it last tested?
• Within how many hours will you notify us of a security incident affecting our data? Who is the contact?
• Have you experienced a breach in the past three years? What changed afterward?
• What are your backup, recovery time, and recovery point commitments for the service we are buying?
• Can we retrieve our data in a usable format if you go out of business or we terminate?

Compliance

• Will you sign a Business Associate Agreement (HIPAA) or Data Processing Agreement (GDPR / state privacy laws) where applicable?
• Which regulations and frameworks do you comply with, and how do you demonstrate it?
• Do you use AI tools on customer data, and if so, under what terms?

Beyond Self-Reports: Evidence That Actually Means Something

A vendor risk questionnaire is self-reported, and vendors under sales pressure answer optimistically. A vendor security assessment should weigh evidence over assertions:

• SOC 2 Type II reports, read for scope (does it cover the service you are buying?), the period, the auditor’s opinion, and the exceptions section, which is where the useful information lives. A SOC 2 logo on a website is marketing; the report is evidence.
• ISO 27001 certificates, checked for currency and scope.
• Penetration test summaries, including the date and whether findings were remediated.
• Independent security ratings from services that scan a vendor’s external footprint, useful as a quick signal for smaller vendors who have no audit reports.
• Breach history from public sources, which often tells you more than the vendor will.
• The BAA or DPA itself, which some vendors offer readily and others resist in ways that reveal how they handle data.

Small vendors, such as a local bookkeeping firm or a marketing freelancer, will not have audit reports, and a formal vendor risk questionnaire may be overkill. For them, the assessment is a conversation: do they use MFA, is their laptop encrypted, where do they store your files, who else has access, and what would they do if their email were compromised. The answers are usually honest and often alarming, and they tell you what access limits to impose. Our article on vetting third-party apps covers the equivalent review for software.

Scoring the Vendor Security Assessment

A simple scoring model keeps vendor security assessment decisions consistent across the business and defensible to an auditor. Rate each topic area red, yellow, or green, then decide:

Result	Meaning	Action
Green across the board	Evidence provided, controls match your requirements	Approve; set the review date
Yellow in one or two areas	Gaps that can be mitigated by contract terms or by limiting access	Approve with conditions; document the compensating controls
Red in access, encryption, or breach notification	Fundamental gap for a vendor that will hold or reach sensitive data	Decline, or restrict the vendor to a role that avoids the gap
Refuses to answer or provide evidence	Information in itself	Decline for critical and important roles

Record the vendor security assessment result, the date, the reviewer, and the next review date in your vendor inventory. That record is what satisfies the FTC Safeguards Rule’s service-provider oversight requirement and the HIPAA expectation of due diligence; see our guide to the FTC Safeguards Rule requirements.

Vendor Contract Security Requirements That Belong in Every Agreement

The vendor security assessment produces findings; vendor contract security requirements make them enforceable. For any vendor with access to systems or sensitive data, the agreement should include these vendor contract security requirements, with your counsel adapting the language:

• Minimum security controls: MFA for vendor staff, encryption in transit and at rest, patching timelines, and security awareness training.
• Breach notification: notice within a defined period of discovery (commonly 24 to 72 hours), with enough detail to meet your own HIPAA, FTC, and New Jersey obligations, and cooperation with your investigation.
• Access limits: least privilege, named accounts, and removal of access at termination.
• Subcontractor flow-down: the same obligations apply to anyone the vendor uses.
• Audit and evidence rights: the right to request current SOC 2 or equivalent reports and to ask security questions annually.
• Data ownership, return, and deletion: your data is yours, returned in a usable format on request, and securely deleted on termination with written confirmation.
• Regulatory agreements: a BAA for HIPAA, a DPA for privacy laws, and any industry-specific terms.
• Insurance: cyber liability coverage at a stated minimum, with certificates on request.
• Consequences: remedies and termination rights if security obligations are not met.

These vendor contract security requirements are standard asks; most reputable vendors accept them. Our post on what happens to your data when you cancel a cloud service covers the return-and-deletion clause in detail, and our cyber insurance coverage guide explains how vendor incidents interact with your own policy.

Building Third-Party Risk Management Around the Assessment

A single vendor security assessment is a snapshot. Third-party risk management is the process that keeps the snapshots current and connected. For a small business it consists of five routines, most of which take minutes once set up:

1. Intake. Every new vendor, app, or integration goes through a short request form that triggers the right depth of vendor security assessment before access is granted. No form, no access.
2. Inventory. Each assessed vendor is recorded with its tier, data held, access granted, contract terms, agreement dates, and next review date.
3. Monitoring. Vendor accounts and integrations are watched in your own systems, and critical vendors’ domains are included in breach and dark web monitoring.
4. Review. Critical vendors are reassessed annually; all vendor access is reviewed quarterly; anything no longer needed is removed.
5. Response. The incident response plan includes a third-party section, and the vendor’s contractual notification obligations are tested in a tabletop exercise.

A managed IT provider can run third-party risk management alongside the rest of your security program, which is usually how a 20-person firm manages to do it at all. Our cybersecurity plan for small business guide shows where vendor management fits in the overall plan.

Assessing the Vendors That Matter Most to NJ Businesses

Your IT provider

No vendor has more access. A vendor security assessment of your managed service provider should cover their own MFA and privileged access management, how they protect the remote management tools that reach every one of your devices, their insurance, their incident response plan, their staff vetting, and their subcontractors. A provider that welcomes these questions is a good sign. Our guide on how to choose an IT support company in NJ covers the broader selection.

EHR, practice management, and case management vendors

These hold your most regulated data, so the vendor security assessment should be thorough. Require the BAA, the SOC 2 or HITRUST report, documented encryption, and clear recovery commitments. Confirm how their support staff access your instance and whether that access is logged.

Accounting, payroll, and financial vendors

A vendor security assessment of financial vendors should go beyond controls. Business email compromise targeting payment flows is the most common vendor-related loss for small businesses. Beyond the questionnaire, establish out-of-band verification for any change in payment instructions, regardless of how trusted the vendor is.

Small local vendors with remote access

Camera installers, phone vendors, HVAC and building-automation contractors, and managed print companies often have standing remote access and rarely strong security. Assess them with the conversation approach above, then limit their access to a segmented network and enable it only when needed.

A One-Page Vendor Security Assessment Template

If you want to start today, this is the one-page record we keep for each assessed vendor. Fill it in from the questionnaire and evidence, store it with the contract, and update it at each review.

• Vendor and service: name, what they do for you, business owner of the relationship.
• Tier: critical, important, or routine, with the reason.
• Data and access: what data they hold or can reach; how they connect; which accounts or integrations exist.
• Evidence received: SOC 2 / ISO / HITRUST report and date; pen test summary and date; insurance certificate; completed questionnaire.
• Scores: governance, data handling, access, operations, incident response, compliance, each red/yellow/green with a one-line note.
• Contract status: BAA/DPA signed; breach notification window; data return and deletion terms; insurance minimum; renewal date.
• Conditions and compensating controls: any access limits or segmentation imposed because of yellow findings.
• Decision and dates: approved / approved with conditions / declined; assessed by; date; next review date.

Twenty such pages, kept current, are a complete third-party risk management file for most small businesses, and they answer the vendor-oversight questions in a HIPAA investigation, an FTC Safeguards Rule review, or a cyber insurance application in minutes.

Common Vendor Security Assessment Mistakes

• Treating the vendor security assessment as a one-time procurement checkbox rather than a recurring review.
• Accepting a certification logo without reading the report.
• Assuming a well-known vendor name means a well-secured vendor, or that a small vendor is too small to matter.
• Skipping the breach-notification clause and the data-return clause.
• Never revisiting access after a vendor relationship ends.
• Assessing the vendor but not the subcontractors the vendor relies on.
• Letting the vendor’s sales team answer the questionnaire instead of its security team.

The U.S. Government Accountability Office has repeatedly found that even large organizations treat supplier oversight as a one-time exercise; its supply chain risk management report is a useful reminder that the gap is universal and the fix is routine.

Vendor Security Assessment: Frequently Asked Questions

How long does a vendor security assessment take?

A vendor security assessment for a critical vendor with audit reports available takes a few hours of review plus the vendor’s response time. For a small vendor, a 30-minute conversation and a short written record.

What if a vendor will not complete our questionnaire?

Large vendors often provide a standard security package or a SOC 2 report instead, which is acceptable. A vendor that offers nothing should not receive access to sensitive systems or data.

Is SOC 2 or ISO 27001 better?

Either demonstrates a mature program. SOC 2 Type II is more common among U.S. SaaS vendors and includes auditor testing over a period; ISO 27001 certifies the management system. Read the scope of whichever you receive.

Do we need to assess vendors that do not touch our data?

Only lightly. A full vendor security assessment is unnecessary for vendors with no system access and no sensitive data; they are routine tier, and a basic check at onboarding is enough.

Who should run vendor security assessments in a small business?

The person who owns the security program, usually with the IT or compliance provider doing the technical review and the owner or office manager handling contracts and relationships.

Move From “Trust Me” to “Show Me”

A vendor security assessment turns an invisible risk into a documented, manageable one, and it is now expected by regulators, insurers, and clients alike. eMDTec runs vendor assessments, maintains vendor inventories, and builds third-party risk management into the written security programs of New Jersey medical practices, law firms, accounting firms, and professional services businesses, as part of our cybersecurity services and managed IT services. Schedule a free consultation and we will start with the vendors that have the most access to your business.

Originally republished with permission from The Technology Press; substantially expanded and updated by eMDTec for New Jersey businesses.