Vendor Risk Assessment Template

Use this vendor risk assessment template to make and evidence a specific onboarding or renewal decision. Tailor the questions to the relationship's inherent risk, validate material answers, record residual risk and conditions, and obtain approval from the right owner. A completed questionnaire alone is not due diligence.

1. Relationship profile

2. Inherent-risk screen

Answer and explain each “yes”.

• Processes personal, confidential, regulated or safety-relevant information.
• Has logical or physical access to production or sensitive environments.
• Uses privileged, persistent, remote or machine access.
• Can materially disrupt a priority product or service.
• Is difficult to replace because of concentration, integration or lock-in.
• Relies on material subcontractors or shared platforms.
• Stores or accesses information across relevant borders.
• Performs development, hosting, managed security or operational control.
• Triggers sector, NIS2, privacy or contractual third-party requirements.

Inherent-risk rating and rationale: [RATING / RATIONALE]

Required assessment depth and approver: [ENTRY]

3. Targeted due-diligence questions

Governance and assurance

1. Who owns security, privacy, continuity and customer incidents?
2. How are risks, exceptions and overdue remediation approved?
3. Which independent reports or certificates cover this service? Provide the full relevant evidence, scope, period, issuer and current status.
4. What material findings remain open, and how do they affect our service?

Identity and access

1. How is customer access authorised, authenticated, reviewed and removed?
2. Where is MFA applied, and what exceptions exist?
3. How are privileged and service identities controlled, logged and reviewed?
4. How quickly is access removed after a role or relationship change?

Assets, vulnerabilities and operations

1. How does the vendor know which assets support the service?
2. How are secure configuration, change and vulnerability treatment governed?
3. What logging and detection cover the service, and who responds?
4. How are customer-reported vulnerabilities received and resolved?

Data and privacy

1. What information is processed, for which instructions, and in which locations?
2. Which subprocessors participate and how are changes notified?
3. How are retention, return, deletion, legal requests and individual rights supported?
4. Which transfer mechanism and supplementary measures apply where required?

Incidents and resilience

1. What events trigger customer notification, through which channel and with what initial facts?
2. How will the vendor support our legal, contractual and authority reporting?
3. What dependencies, recovery objectives and tested restore results apply to the service?
4. What happens if ordinary communications or a critical subservice provider is unavailable?

People, physical security and exit

1. What screening, confidentiality, training and offboarding apply to relevant personnel?
2. Which physical and environmental controls protect service locations?
3. How will data, configurations, logs and knowledge be exported at exit?
4. How are access removal and deletion demonstrated after termination?

4. Evidence log

Do not record “ISO certified” or “SOC 2” without checking the actual entity, scope, edition or period, opinion or status, exceptions and relevance to the service.

5. Findings and residual risk

Critical gates that prevent approval: [DEFINE FOR THIS RELATIONSHIP].

6. Contract requirements

• Defined service, use, access and information scope
• Security and confidentiality obligations
• Subcontractor approval or notification
• Incident notification and cooperation
• Evidence, assessment and remediation rights
• Continuity and recovery commitments
• Data location, return, retention and deletion
• Material-change notification
• Exit and transition assistance
• Applicable processor or sector-specific clauses

7. Decision

8. Ongoing monitoring and exit

Track service performance, incidents, material changes, assurance expiry, open actions, subprocessor changes and concentration. Reassess on risk-based triggers. For material suppliers, maintain a tested exit record covering alternatives, export, credentials, knowledge transfer, continuity and deletion confirmation.

For tailoring and independent review, see our vendor-risk services.

Sources and review

This template was substantively reviewed on 8 August 2026. It replaces invented breach percentages and fixed question counts with risk-scoped questions, evidence validation and approval gates.

• NIST — SP 800-161 Rev. 1 cybersecurity supply-chain risk management
• NIST — SP 1326 due-diligence assessment quick-start guide
• EUR-Lex — Directive (EU) 2022/2555, Article 21