How do you assess the security of your vendors?
A people and suppliers question from almost every security questionnaire. Here is a model answer, the evidence a reviewer may ask for, and what to say if you don't do this yet.
A model answer
Vendors that handle customer data are reviewed before use, by checking their security documentation, such as a SOC 2 report or trust center, and their data processing terms. They are re-reviewed [every year]. Our current subprocessors are listed on our trust center.
Replace the parts in square brackets with what's true for you, and only answer yes to what you do.
Evidence a reviewer may ask for
- Your vendor review checklist
- Your published subprocessor list
If you don't do this yet
Start by listing your subprocessors, then record a short review for each. Pointing a reviewer at a published list already answers half the question.
Related questions
Do you perform background checks on employees?A model answer, the evidence behind it, and what to say if you don't do it yet.Do employees receive security awareness training?A model answer, the evidence behind it, and what to say if you don't do it yet.Security questionnaires without SOC 2How to answer a customer's questionnaire honestly before you have an audit.
Answer it once, on your trust center, for every reviewer.
From £39 a month. No sales call.