A vendor security assessment checklist works through a third party's security risk in stages: tiering the vendor by the data it touches, testing its core controls, checking certifications and contract safeguards, then monitoring it until secure offboarding.
Updated 13 Oct 2026 · Reviewed by the Spendflo procurement team
Set the vendor's risk tier from the data it will hold, then work through the checks that tier needs. Open any check to see the evidence to request and the red flag that should pause approval.
Get the vendor security assessment checklist as an Excel tracker with owners, status drop-downs and a progress score.
A vendor security assessment is a structured review of how well a supplier protects the data and systems you share with it, covering its controls, certifications and contract terms, and repeated over the life of the relationship rather than done once.
It sits inside your wider third-party risk process. Procurement starts it at the purchase request, security runs it, legal turns the gaps into contract terms, and the business owner keeps it current at renewal.
The depth depends on the data. A vendor that only sees your company name needs a few checks; one holding customer health records needs every line of this vendor security assessment checklist, backed by independent evidence.
A complete checklist moves from tiering, through the core security domains, to compliance evidence and lifecycle controls.
| Area | What you are checking | Usual owner |
|---|---|---|
| Identification and tiering | Who the vendor is, what data it gets, how critical it is | Procurement, Security |
| Governance and certifications | Security leadership, policies, SOC 2, ISO 27001, SIG or CAIQ | Security |
| Access and data protection | MFA, role-based access, encryption, retention and deletion | Security, IT |
| Vulnerability and incident response | Scanning, patching, pen tests, IR plan, breach notice | Security |
| Continuity and fourth parties | RTO, RPO, tested backups, subprocessors | IT, Security |
| Contract and lifecycle | Audit rights, DPA, security SLAs, monitoring, offboarding | Legal, Security |
A certificate on file is not the same as assurance. Check these points before you accept any document as evidence.
| Evidence | What to check | Red flag |
|---|---|---|
| SOC 2 Type I | Controls designed at one point in time | Treated as proof the controls work |
| SOC 2 Type II | Period covered, exceptions, subservice organisations | Exceptions with no management response |
| Bridge letter | Covers the gap since the report period ended | Gap of more than a few months |
| ISO/IEC 27001 | Scope and statement of applicability | Scope covers head office, not the product |
| Pen test summary | Tester, date, scope and open findings | Internal test only, critical items open |
| Complementary user controls | What you must do on your side | Controls you have not switched on |
Software and SaaS vendors add risks that come from logins, integrations and shared infrastructure. Add these ten checks for any software vendor.
Download the vendor security assessment checklist so every owner can work their own rows in Excel or Google Sheets, with status and dates.
For Tier 1 vendors, send a SIG or CAIQ questionnaire. For everyone else, these fifteen questions cover the essentials and map to the checklist above.
Agree the rules before results come in, so the decision does not bend to how urgently the business wants the tool.
| Outcome | When it applies | What happens next |
|---|---|---|
| Pass | All checks for the tier done, no open red flags | Approve and set the review date |
| Conditional | Gaps that a contract term or deadline can fix | Approve with conditions in the contract |
| Fail | No MFA, no encryption, refused DPA or undisclosed breach | Decline or escalate to a risk owner |
Set the tier from the data the vendor holds and how much you depend on it. The tier decides how many checks apply and how often you repeat them.
Holds PII, PHI, financial records or source code, or runs a core system.
Independent evidence for every check
Limited data access or a non-core system.
Skip the Tier 1-only checks
No sensitive data and easy to replace.
Plus the 15 questions above
Each step has one owner and one output, so no vendor reaches your data with checks still open.
Profile the vendor and classify the data it will hold.
Send the questionnaire and ask for certificates and reports.
Read the evidence and test answers against it.
Pass, pass with contract conditions, or fail.
Re-assess on the tier's cycle or after a trigger.
Here is a completed assessment of an HR software vendor, with the two flags it raised and the outcome. The companies and figures are illustrative.
| Check | Owner | Evidence received | Status |
|---|---|---|---|
| SOC 2 Type II report current and in scope | Security | Report to June, bridge letter to Sep | Done |
| MFA enforced for all staff and admins | Security | Policy and screenshot received | Done |
| Independent penetration test in the last year | Security | Two high findings still open | Flagged |
| Breach notice window agreed | Legal | DPA says 'without undue delay' only | Flagged |
| Subprocessors listed with locations | Security | List of six, EU and US | Done |
| Data return and destruction at exit | Security | Deletion certificate template agreed | Done |
+ 40 more checks done, evidence filed
All 46 checks, the question bank and the decision rules, ready to fill in. Free, no credit card.
FreeNo credit cardWork email only
| # | Check | Owner | Status |
|---|---|---|---|
| 1 | Vendor profile recorded: legal name, HQ, contact, service | Procurement | Done |
| 2 | Data shared classified: PII, PHI, financial, source code | Security | In progress |
| 3 | Risk tier set from data access and dependency | Security | Flagged |
| 4 | Integration points and system access mapped | IT | Done |
It is a review of how a supplier protects the data and systems you share with it, checking controls, certifications and contract terms before approval and again over time. The free download turns it into 46 checks with evidence and red flags.
For vendors, the five steps are: tier the vendor by data and dependency, request evidence, verify it, decide pass, conditional or fail, then monitor and re-assess. Each step has a named owner so nothing is approved with checks open.
Third-party risk management usually runs through planning and tiering, due diligence, contracting, ongoing monitoring and offboarding. The security assessment sits mainly in due diligence and monitoring, with contract and exit checks in the other phases.
A common model is: identify assets, identify threats, identify vulnerabilities, review existing controls, judge likelihood, judge impact, then rate the risk and recommend controls. For a vendor, the assets are the data and systems you share.
Yes, you can download this checklist free as an Excel file, a Google Sheet or a printable PDF. Every version includes the question bank and the software vendor security checks.
Put the security gate at the purchase request
Spendflo is procurement software, not a security scanner. Intake and approvals route new software to security before anyone signs, third-party risk management tracks assessments and re-reviews, and the Contracts Agent surfaces breach notice, audit and subprocessor clauses. Spendflo has handled 15,000+ agreements.
Enter your work email and your download starts straight away.
Need another format? Pick one below.
Google Sheets: upload the Excel file to Drive and open it with Google Sheets.
