Vendor Cybersecurity Risk Assessment Checklist (25 Items)

Short answer: A vendor cybersecurity risk assessment checklist is a structured list of security requirements and questions you verify before onboarding a vendor — and periodically throughout the relationship — to confirm they meet your security baseline. This checklist covers 25 items across six domains: security controls, identity and access, data handling, compliance and certifications, incident response, and business continuity.

TL;DR: Use this checklist before signing any new vendor contract and at each annual review for Tier 1 and Tier 2 vendors. Every item has a clear pass/fail criterion so you can produce an evidence-backed assessment, not just a gut-feel rating.

Key Takeaways - A majority of organizations — regularly above 70% in annual surveys — report experiencing at least one material third-party cybersecurity incident (Prevalent Third-Party Risk Management Report 2024), making structured pre-onboarding assessment non-negotiable. - Organize assessments by domain — controls, identity, data, compliance, IR, and resilience — so nothing falls through the cracks. - Request evidence, not assertions: a SOC 2 Type II report is evidence; a vendor saying "we take security seriously" is not. - Calibrate checklist depth to your vendor tier — apply all 25 items to Tier 1 vendors; use a lighter subset for Tier 3. - The Shared Assessments SIG questionnaire is the industry-standard complement to a checklist like this one.

How to use this checklist

This checklist is designed for practical use, not compliance theater. For each item:

• Status: Mark Pass, Fail, Partial, or N/A.
• Evidence required: The specific documentation you should request.
• Risk if absent: What the control gap means in practice.

Apply all 25 items to Tier 1 (Critical) vendors. For Tier 2 (Important) vendors, focus on Domains 1–4. For Tier 3 (Routine) vendors, a lightweight self-attestation covering Domain 1 basics is usually sufficient.

For the vendor tiering model that determines which items apply at which depth, see the TPRM framework guide.

Domain 1: Security controls baseline

These are the foundational technical controls you should expect from any vendor that handles your data or accesses your systems.

1. Patch and vulnerability management

• [ ] Does the vendor have a documented patch management policy with defined SLAs?
• Evidence: Policy document or excerpt; sample patch cycle data or CMDB screenshot.
• Pass criterion: Critical patches applied within 30 days; high within 60 days.
• Risk if absent: Unpatched systems are the most common initial access vector in vendor compromises.

2. Endpoint detection and response

• [ ] Is EDR deployed on all endpoints that interact with your environment?
• Evidence: EDR tool name and version; confirmation of deployment scope.
• Pass criterion: EDR deployed on 100% of relevant endpoints with active monitoring.
• Risk if absent: Malware on vendor endpoints can pivot to your environment via shared connections.

3. Network segmentation

• [ ] Is the network environment used to service your account segmented from the vendor's other environments?
• Evidence: Network diagram or written attestation; firewall rule overview.
• Pass criterion: Dedicated or isolated environment with documented segmentation controls.
• Risk if absent: A breach in an unrelated vendor environment can laterally reach your data.

4. Encryption in transit and at rest

• [ ] Is all data transmitted to/from and stored by the vendor encrypted to current standards?
• Evidence: Encryption policy; confirmation of TLS 1.2+ for transit and AES-256 (or equivalent) for rest.
• Pass criterion: No unencrypted data paths for data in scope; encryption keys managed separately from data.
• Risk if absent: Unencrypted data is immediately usable by an attacker upon exfiltration.

5. Penetration testing

• [ ] Does the vendor conduct annual penetration tests by a qualified third party?
• Evidence: Executive summary of most recent pentest (dated within 12 months); remediation status of findings.
• Pass criterion: Annual test completed; high/critical findings remediated or formally accepted with compensating controls.
• Risk if absent: Unknown vulnerabilities persist indefinitely; no external validation of the vendor's security posture.

Domain 2: Identity and access management

Poor identity hygiene in vendor environments is a leading entry point for attacks — the MOVEit, SolarWinds, and Okta incidents all had IAM components. The CISA MOVEit advisory illustrates how a single vendor vulnerability can cascade across thousands of organizations.

6. Multi-factor authentication

• [ ] Is MFA enforced for all vendor personnel accessing systems that touch your data?
• Evidence: IAM policy document; confirmation of MFA enforcement scope (admin, all users, etc.).
• Pass criterion: MFA required for all accounts, not just administrators; phishing-resistant MFA (FIDO2/hardware token) preferred for privileged accounts.
• Risk if absent: Credential phishing is trivial — MFA absence means compromised passwords equal system access.

7. Privileged access management

• [ ] Are privileged accounts (admin, service accounts, root) managed through a PAM solution or equivalent control?
• Evidence: PAM tool name; just-in-time (JIT) access policy or equivalent.
• Pass criterion: No standing privileged access; audit trail of all privileged actions.
• Risk if absent: Stolen privileged credentials provide unconstrained access across the vendor's environment.

8. Access reviews

• [ ] Does the vendor conduct periodic access reviews to remove stale or excessive permissions?
• Evidence: Access review policy; sample review completion records.
• Pass criterion: Access reviews conducted at least quarterly for privileged accounts, annually for all others.
• Risk if absent: Orphaned accounts and excessive permissions accumulate over time, expanding the attack surface.

9. Offboarding procedures

• [ ] Is there a documented process to revoke access within 24 hours of employee termination?
• Evidence: HR-to-IT offboarding procedure; sample termination ticket showing access revocation timing.
• Pass criterion: Access revoked same-day for voluntary departures; immediate revocation for involuntary terminations.
• Risk if absent: Former employees retaining access is a common source of insider-threat incidents.

Domain 3: Data handling and privacy

10. Data classification and inventory

• [ ] Can the vendor demonstrate that your data is classified and inventoried separately from other customers?
• Evidence: Data classification policy; data flow diagram showing how your data is labeled and segregated.
• Pass criterion: Your data is identifiable in the vendor's environment; classification maps to your data sensitivity levels.
• Risk if absent: Inability to identify and protect your data in the event of a vendor-side incident.

11. Data residency and cross-border transfers

• [ ] Does the vendor store and process your data only in jurisdictions you have approved?
• Evidence: Data processing addendum (DPA); list of sub-processing locations.
• Pass criterion: All storage and processing locations documented and within approved jurisdictions; appropriate transfer mechanisms (SCCs, adequacy decisions) in place for cross-border flows.
• Risk if absent: Regulatory violations under GDPR, CCPA, and sector-specific rules; potential seizure of data by foreign authorities.

12. Data retention and secure deletion

• [ ] Does the vendor have a documented retention schedule and a secure deletion process?
• Evidence: Retention policy; certificate of destruction template or process description.
• Pass criterion: Retention aligned to regulatory requirements; data destroyed within 30 days of contract termination using NIST SP 800-88-compliant methods.
• Risk if absent: Data retained beyond legitimate need increases breach surface and creates regulatory liability.

13. Sub-processor (fourth-party) disclosure

• [ ] Does the vendor disclose all sub-processors who touch your data, and notify you of changes?
• Evidence: Current sub-processor list; change notification policy (typically 30-day advance notice).
• Pass criterion: Complete sub-processor list provided; change notification procedure contractually binding.
• Risk if absent: Unknown fourth parties introduce risk you cannot assess or manage; regulatory violations possible under GDPR Article 28.

Domain 4: Compliance and certifications

14. SOC 2 Type II report

• [ ] Does the vendor have a current SOC 2 Type II report (dated within 12 months) with an unmodified opinion?
• Evidence: Full SOC 2 Type II report (or executive summary for initial review) from a reputable auditor.
• Pass criterion: Report issued within 12 months; unmodified opinion; exceptions noted with remediation status.
• Risk if absent: No independent validation that vendor controls operate effectively over time.

15. ISO 27001 certification

• [ ] Is the vendor ISO 27001:2022 certified, and does the certification scope cover the systems handling your data?
• Evidence: ISO 27001 certificate with scope description; issuing certification body name.
• Pass criterion: Certificate current and not expired; scope explicitly covers the products/services you consume.
• Risk if absent: ISO certification is an internationally recognized signal of systematic information security management; absence increases due-diligence burden.

16. Regulatory and legal compliance

• [ ] Can the vendor demonstrate compliance with all regulations that apply to the data they process on your behalf?
• Evidence: Compliance attestations, DPA (for GDPR), BAA (for HIPAA where applicable), PCI AOC (for card data).
• Pass criterion: All required regulatory instruments in place and current; vendor can identify the legal basis for processing.
• Risk if absent: Your organization inherits regulatory liability for vendor non-compliance with respect to your data.

17. Security awareness training

• [ ] Do all vendor employees with access to your data complete annual security awareness training?
• Evidence: Training program description; completion rate data.
• Pass criterion: 100% completion for in-scope personnel annually; phishing simulation included.
• Risk if absent: Social engineering is the leading cause of initial access; untrained employees are the easiest target.

18. Vendor risk program for their own suppliers

• [ ] Does the vendor operate its own third-party risk management program?
• Evidence: TPRM policy; sample vendor questionnaire or assessment process.
• Pass criterion: Documented TPRM program that covers critical sub-processors; evidence of periodic reassessment.
• Risk if absent: Fourth-party risk is invisible — a breach at the vendor's vendor becomes your problem too.

Domain 5: Incident response

19. Documented incident response plan

• [ ] Does the vendor have a written IR plan that covers the detection, containment, eradication, and recovery phases?
• Evidence: IR plan (or executive summary); RACI showing response roles.
• Pass criterion: Written plan exists; updated within 12 months; roles and escalation paths clearly defined.
• Risk if absent: An undocumented IR response during a live incident is slower, more chaotic, and more likely to result in extended exposure.

20. Breach notification commitment

• [ ] Is the vendor contractually committed to notifying you within a defined window of a confirmed breach affecting your data?
• Evidence: Contract or DPA clause specifying notification SLA (typically 24–72 hours).
• Pass criterion: Contractual notification SLA in place; notification covers suspected as well as confirmed incidents.
• Risk if absent: Without contractual obligation, vendors may delay notification — costing you critical response time and triggering your own regulatory breach notification deadlines.

21. 24/7 security operations capability

• [ ] Does the vendor have 24/7 security monitoring in place (internal SOC or MSSP)?
• Evidence: SOC staffing model or MSSP contract; SLA for detection and response.
• Pass criterion: Continuous monitoring with defined response SLAs; escalation procedure documented.
• Risk if absent: Attacks that begin outside business hours go undetected until the next working day.

22. Tabletop and IR testing

• [ ] Has the vendor tested its IR plan through tabletop exercises or live simulations in the past 12 months?
• Evidence: Tabletop exercise summary or after-action report; testing frequency.
• Pass criterion: Annual tabletop at minimum; findings from exercises tracked to completion.
• Risk if absent: An untested IR plan is a theoretical plan — real incidents reveal gaps, and better to find them in a tabletop than during an actual breach.

Domain 6: Business continuity and resilience

23. Business continuity and disaster recovery plan

• [ ] Does the vendor have a documented BCP/DR plan that covers loss of their primary environment?
• Evidence: BCP/DR plan summary; most recent DR test results.
• Pass criterion: Written plan covering major failure scenarios; tested within the past 12 months; results documented.
• Risk if absent: Vendor failure or major outage with no recovery capability can create extended service disruption for your operations.

24. Recovery time and recovery point objectives

• [ ] Are the vendor's contractual RTO and RPO commitments documented and backed by test evidence?
• Evidence: SLA or contract specifying RTO/RPO; DR test results confirming these targets are achievable.
• Pass criterion: RTO/RPO commitments align to your business requirements; test evidence confirms targets are met consistently.
• Risk if absent: Vendor SLA commitments unverified by testing are commercial commitments, not operational guarantees.

25. Backup integrity and restore testing

• [ ] Does the vendor regularly test backup restoration, not just backup completion?
• Evidence: Backup and restore test schedule; recent restore test results.
• Pass criterion: Restore testing performed at least quarterly; results demonstrate successful recovery to a known-good state.
• Risk if absent: Backups that have never been restored are an assumption, not a capability — corrupted or incomplete backups are only discovered during an actual recovery event.

Assessment scoring and decision guide

After completing the checklist, tally results by domain. Use this decision guide for Tier 1 vendors:

For any Domain 5 (Incident Response) Fail items, escalate regardless of overall score — a vendor without breach notification and IR capabilities creates unacceptable response-time risk.

For the scoring methodology that turns checklist results into a numerical risk rating, see How to Build a Vendor Risk Scoring Model.

Frequently asked questions

What is a vendor cybersecurity risk assessment checklist?

A vendor cybersecurity risk assessment checklist is a structured list of security requirements and verification questions used to evaluate a vendor's security posture before onboarding and during periodic reviews. A good checklist covers technical controls, identity management, data handling practices, compliance certifications, incident response capability, and business continuity planning.

How many items should a vendor security assessment include?

The depth depends on vendor tier. For Tier 1 (critical) vendors — those with access to sensitive data or critical systems — a comprehensive assessment of 20–30+ items across multiple domains is appropriate. For lower-risk vendors, a lighter-weight self-attestation covering 8–12 core items is usually sufficient. The Shared Assessments SIG questionnaire is the industry standard for comprehensive assessments.

What evidence should you request in a vendor assessment?

Request evidence, not assertions. Key documents include: SOC 2 Type II report (within 12 months), ISO 27001 certificate (with scope), most recent penetration test executive summary, data processing addendum, sub-processor list, patch management policy, and IR plan summary. A vendor that cannot provide these documents for a Tier 1 relationship is itself a risk signal.

How often should vendor assessments be repeated?

Tier 1 vendors should be formally reassessed at least annually. Reassessment should also be triggered by material events: a public breach disclosure, an acquisition, a significant new product or integration, or a change in sub-processors. Tier 2 vendors typically warrant reassessment every 18–24 months. Tier 3 vendors can be reviewed at contract renewal.

---

ThreatBlock's TPRM course trains professionals on vendor risk assessment and third-party risk programs from assessment to ongoing monitoring.

About the author: Samaksh is Lead Instructor at ThreatBlock and holds the OSCP, CRTP, CRTO, and CEH certifications, with expertise in cybersecurity risk management and vendor security assessment. Read more on the author page · Editorial policy.