Vendor due diligence: one process for many frameworks

Every major framework asks you to manage supplier risk, as our comparison of vendor and supply-chain requirements shows. The requirements overlap so much that one process, designed once, can satisfy all of them. Here is a structure that does.

Step 1: one inventory

List every supplier with access to your systems, data or facilities, and for each: what they do, what data they touch, and which frameworks that brings into play (cardholder data for PCI DSS, ePHI for HIPAA, personal data for GDPR, services that support an NIS2-regulated service). PCI DSS (12.8.1), ISO 27001 (A.5.19) and the CIS Controls (15.1) all start here.

Step 2: tier them

• Tier 1: access to sensitive data or production systems, or critical to your service.
• Tier 2: limited access or moderate criticality.
• Tier 3: no access to sensitive data; low impact if they fail.

Tiering is what keeps the process proportionate. CIS calls it classifying service providers (15.3).

Step 3: assess by tier

• Tier 1: an independent assurance report covering the service you use (SOC 2 Type II or ISO 27001 certificate with relevant scope), plus a short questionnaire for what the report doesn't cover. Read the report: scope, period, exceptions, carve-outs and the controls you're expected to run.
• Tier 2: a standard questionnaire, or the report if they have one.
• Tier 3: a basic check at onboarding.

Step 4: contract once, covering everything

Write security terms that cover every framework at once:

• Security obligations proportionate to the service.
• Breach notification to you, with a deadline short enough for your own obligations (NIS2's 24 hours, GDPR's 72).
• GDPR Article 28 terms where they process personal data on your behalf; a business associate agreement where HIPAA applies.
• Audit or assessment rights, and data return or deletion at exit.
• For PCI DSS, acknowledgement of their responsibilities for cardholder data (12.8.2) and a documented split of responsibilities (12.8.5).

Step 5: monitor and offboard

Re-assess Tier 1 suppliers annually (PCI DSS requires annual monitoring of service providers' compliance, 12.8.4), Tier 2 every year or two, and react to incidents and changes. At exit, revoke access, recover or delete data, and record it (CIS 15.7).

A short questionnaire that works

For suppliers without an independent assurance report, a short questionnaire beats a long one, because people answer short ones properly. Ten questions cover most of what every framework asks:

1. What of ours will you access, store or process, and where?
2. Do you hold a current SOC 2 report or ISO 27001 certificate covering this service?
3. Is MFA enforced for all access to systems holding our data?
4. How quickly are critical vulnerabilities patched?
5. Is our data encrypted at rest and in transit?
6. Are backups taken, protected and tested?
7. How and how fast will you notify us of an incident affecting our data?
8. Which subcontractors handle our data?
9. How is our data returned or deleted when the contract ends?
10. Who is your security contact?

Map each answer to your requirements once, and reuse the mapping for every supplier. The gap analysis and the supply chain risk topic show how each framework phrases these requirements.

Key takeaways

• One supplier inventory, tiered by risk, serves every framework.
• Accept independent reports where their scope fits, and read them.
• Write contract terms once to cover every obligation.

One record per supplier

Keep everything (tier, assessments, reports read, contract terms, reviews) in one place per supplier. Auditors for each framework can then find their evidence in the same record.

The Vendor Risk topic page lists every requirement with its source, and our post on why "SOC 2 certified" is the wrong question covers reading supplier reports.

Questions

Can I accept a vendor's SOC 2 report instead of a questionnaire?

Often, yes, if the report is a Type II, recent, covers the service you use, and you read the exceptions and complementary user entity controls. A report that doesn't cover your service tells you little.

Which frameworks require vendor contracts to include security terms?

ISO 27001 (A.5.20), PCI DSS (12.8.2), GDPR for processors (Article 28), HIPAA business associate agreements, and NIS2's supply chain measures all require security terms in supplier agreements.

How often should suppliers be reassessed?

Critical suppliers at least annually (PCI DSS requires annual monitoring of service providers' compliance), others every year or two, and any supplier after a significant incident or change in the service.