Vendor Risk
Critical and high-risk vendors undergo security review before onboarding and periodically thereafter.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
Before relying on a critical or high-risk vendor, and periodically afterward, the company understands the vendor’s security posture, assurance scope, material gaps, customer responsibilities, and remaining risk.
First SOC 2 program
For high-impact vendors, obtain current assurance documents and targeted security answers, confirm that they cover the service and locations you use, record material findings, and have a security decision-maker approve use or require safeguards before onboarding.
As the company scales
Use tier-based review workflows, specialist review for cloud, privacy, resilience, or product-security risk, structured analysis of independent reports and certifications, remediation tracking, expiration reminders, and reassessment triggered by incidents or material change.
Use the vendor’s tier, data, access, service dependency, customer impact, and intended integration to choose the questions, documents, specialists, and approval needed.
You should end up with: A review plan tied to the vendor’s actual risk profile.
Obtain relevant independent reports, certifications, security responses, architecture information, incident history, resilience information, and supporting policies or test summaries.
You should end up with: A dated review package with document periods, versions, and source recorded.
Confirm that the evidence covers the product, legal entity, hosting environment, locations, services, and period the company will rely on, and note external-provider carve-outs or customer responsibilities.
You should end up with: A scope analysis identifying relevant coverage, gaps, dependencies, and required customer actions.
Evaluate exceptions, qualifications, overdue remediation, control gaps, incident history, and unanswered questions in the context of the company’s intended data and use.
You should end up with: A findings log with severity, impact, owner, and required resolution.
Approve, conditionally approve, reject, or escalate the vendor, documenting rationale, compensating measures, contract needs, residual risk, and the authority making the decision.
You should end up with: A dated risk decision linked to findings, approvals, and prerequisite actions.
Close prerequisites before use where required, monitor vendor remediation, and set the next review based on tier, evidence expiration, incidents, and material service changes.
You should end up with: Completed action evidence and a scheduled, risk-based reassessment date.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
Confirm what the record proves
The vendor supplied current, service-relevant answers about safeguards, access, data handling, resilience, incidents, and external providers for review.
Include this context
vendor service and scope
Include this context
questionnaire version and date
Include this context
respondent and authority
Include this context
material responses
Include this context
supporting document links
Include this context
unanswered or qualified items
Weak evidence to avoid
A questionnaire completed three years earlier for a different vendor product, with blank high-risk questions and no respondent, date, scope, or supporting material.
Confirm what the record proves
The reviewer analyzed evidence relevance, material gaps, assurance exceptions, data and access risks, customer responsibilities, and follow-up rather than only collecting documents.
Include this context
vendor and review identifier
Include this context
reviewer and date
Include this context
documents and scope assessed
Include this context
findings and severity
Include this context
questions and resolution
Include this context
recommended disposition
Weak evidence to avoid
A note reading SOC received, no concerns with no report period, scope analysis, exception review, customer responsibilities, findings, or reviewer rationale.
Confirm what the record proves
An accountable authority approved, conditionally approved, rejected, or escalated vendor use based on documented findings, residual risk, and required safeguards.
Include this context
vendor and review identifier
Include this context
decision and date
Include this context
decision authority
Include this context
findings and residual risk
Include this context
conditions or safeguards
Include this context
next reassessment date
Weak evidence to avoid
A procurement status of approved without named security authority, considered findings, conditions, residual-risk rationale, or reassessment date.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
Confirm what the record proves
An independent service-auditor report covers the relevant vendor entity, service, system, criteria, and period, and reviewers evaluated exceptions, subservice treatment, and complementary user responsibilities.
Include this context
report type and period
Include this context
vendor entity and service scope
Include this context
auditor opinion
Include this context
exceptions or deviations
Include this context
subservice organization treatment
Include this context
complementary user responsibilities
Weak evidence to avoid
A report cover page stored as proof of review without confirming the product or period, reading the opinion, assessing exceptions, or addressing complementary responsibilities.
Confirm what the record proves
The certification was valid when reviewed, its certification body's accreditation status was independently verified, and its stated organization, locations, and information-security scope include the vendor service on which the company relies.
Include this context
certificate holder and legal entity
Include this context
standard, certificate number, and scope statement
Include this context
covered locations
Include this context
issuing certification body
Include this context
accreditation body and certification-body accreditation status
Include this context
issue and expiration dates plus verification source and date
Weak evidence to avoid
A certification logo from the vendor website with no certificate number, legal entity, product scope, locations, validity dates, accreditation body or status, or dated registry or issuer verification.
Type 1
Current due-diligence requirements by tier, the current review workflow, and a recently approved critical-vendor file containing relevant assurance evidence, analysis, findings, and decision as of the examination date.
Type 2
Every critical or high-risk vendor onboarded during the review period, every active critical or high-risk vendor whose periodic reassessment fell due, and every such vendor requiring triggered review after an incident or material scope change.
Reconcile the critical and high-risk inventory plus incident and scope-change triggers to completed review records, then verify each review has in-scope current evidence, documented analysis, disposition of findings, and an authorized decision.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: Before relying on a critical or high-risk vendor, and periodically afterward, the company understands the vendor’s security posture, assurance scope, material gaps, customer responsibilities, and remaining risk.
Compare the documented owner with the intended role (Vendor Risk Owner / CISO / Legal), then compare dated records with the stated cadence: Prior to onboarding; periodic based on risk; at least annually for critical/high.
Reconcile the critical and high-risk inventory plus incident and scope-change triggers to completed review records, then verify each review has in-scope current evidence, documented analysis, disposition of findings, and an authorized decision.
Current due-diligence requirements by tier, the current review workflow, and a recently approved critical-vendor file containing relevant assurance evidence, analysis, findings, and decision as of the examination date.
Every critical or high-risk vendor onboarded during the review period, every active critical or high-risk vendor whose periodic reassessment fell due, and every such vendor requiring triggered review after an incident or material scope change.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
For each selected record, confirm it demonstrates The vendor supplied current, service-relevant answers about safeguards, access, data handling, resilience, incidents, and external providers for review.
For each selected record, confirm it demonstrates The reviewer analyzed evidence relevance, material gaps, assurance exceptions, data and access risks, customer responsibilities, and follow-up rather than only collecting documents.
For each selected record, confirm it demonstrates An accountable authority approved, conditionally approved, rejected, or escalated vendor use based on documented findings, residual risk, and required safeguards.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
For each selected record, confirm it demonstrates An independent service-auditor report covers the relevant vendor entity, service, system, criteria, and period, and reviewers evaluated exceptions, subservice treatment, and complementary user responsibilities.
For each selected record, confirm it demonstrates The certification was valid when reviewed, its certification body's accreditation status was independently verified, and its stated organization, locations, and information-security scope include the vendor service on which the company relies.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.