Vendor risk management guides
Practical, framework-mapped guides to vendor due diligence for teams without a GRC department: how to inventory and tier third parties, what to ask them, how to score the answers, and what SOC 2, ISO 27001 and GDPR auditors expect to find in the file.
Vetting and onboarding vendors
What to check before a vendor is approved, and the record to keep for each check.
- Fundamentals
- Checklist
- Vendor vetting
How to vet a vendor: a step-by-step vetting checklist
The vendor vetting process from first call to approval, with what to check at each step and a free Excel checklist to run it.
10 min read
- Checklist
- Onboarding
Vendor onboarding checklist: the checks to finish before the contract is signed
Twelve checks, grouped by who owns them, with the one record to keep for each so the file is audit-ready from day one.
11 min read
- Checklist
- US onboarding
US vendor onboarding: W-9, SAM.gov, OFAC, insurance and bank verification
Twelve checks before the first payment, and the one callback that stops bank detail change fraud.
5 min read
- Fundamentals
- Checklist
Vendor due diligence: a practical guide for small and mid-sized businesses
The end-to-end process — scoping, questionnaires, evidence, scoring, review cadence — sized for a team of one.
9 min read
- Questionnaires
- Scoring
Vendor risk assessment questionnaire: what to ask, and how to score the answers
The questions that matter by risk tier, mapped to the controls auditors recognise, with a scoring method you can explain.
8 min read
Running a vendor risk program
Tiers, policy and review cadence for a team without a GRC department.
- Programme design
- SMB
Third-party risk management for small businesses: a programme without a GRC team
Enterprise TPRM assumes a department. This is the version for a company with none — and what it still must not skip.
7 min read
- Programme design
- Scoring
Vendor risk tiering: how to classify third parties and set a review cadence
Four tiers, three questions to assign them, and the review cadence each one earns — so effort goes where the risk is.
7 min read
- Programme design
- Audit
Vendor risk management policy template: ten sections you can copy and adapt
Policy text for all ten sections, a note on adapting each, and where SOC 2 and ISO 27001 auditors will test it.
9 min read
ISO 27001 supplier security
The 2022 Annex A supplier controls, together and one by one, with the evidence auditors sample.
- ISO 27001
- Audit
ISO 27001 vendor management: meeting Annex A 5.19 to 5.23 with evidence
The five supplier controls in the 2022 edition, what each demands, and the records that satisfy them.
11 min read
- ISO 27001
- Annex A
ISO 27001 Annex A 5.19 to 5.22: supplier security controls explained
The four supplier lifecycle controls as one process: select, contract, look down the chain, keep watching. One supplier traced through all four.
9 min read
- ISO 27001
- Annex A
ISO 27001 Annex A 5.19: Information security in supplier relationships
The control that asks for a supplier security process: types of supplier, tiers, requirements, and the records that prove it ran.
5 min read
- ISO 27001
- Annex A
ISO 27001 Annex A 5.20: Addressing information security within supplier agreements
Which security requirements belong in the supplier contract, how to handle vendors on their own paper, and the gap log auditors ask for.
5 min read
- ISO 27001
- Annex A
ISO 27001 Annex A 5.21: Managing information security in the ICT supply chain
Your suppliers have suppliers. What 5.21 expects you to know about them, and how to evidence it without auditing the whole chain.
5 min read
- ISO 27001
- Annex A
ISO 27001 Annex A 5.22: Monitoring, review and change management of supplier services
Assessing a supplier once is not enough. Review cadence, change triggers and the dated records that show monitoring actually happened.
5 min read
- ISO 27001
- Annex A
ISO 27001 Annex A 5.23: Information security for use of cloud services
The control new in 2022: a process for acquiring, using, managing and exiting cloud services, and the exit plan most teams are missing.
5 min read
Privacy, health data and AI
Vendors that process personal data, protected health information, or your data through AI.
- GDPR
- Privacy
GDPR Article 28: processor due diligence and the DPA checklist
Article 28 makes you accountable for your processors. The checklist, the DPA clauses, SCCs, the transfer impact assessment and the sub-processor checks.
28 min read
- HIPAA
- Healthcare
HIPAA vendor risk assessment: vetting business associates under the Security Rule
What the Security Rule expects before ePHI reaches a vendor, with a checklist by risk tier and the evidence worth requesting.
10 min read
- AI
- Checklist
AI vendor due diligence: a checklist for vendors that use AI on your data
Training use, retention, model providers as fourth parties, output review, IP indemnity and prompt injection: the questions to add for any vendor using AI.
10 min read
SOC 2 and ISO 9001 audits
What auditors expect to find in your vendor file.
- SOC 2
- Audit
SOC 2 vendor management: what auditors expect from your third-party programme
CC9.2, subservice organisations, and the vendor evidence an auditor will sample. Prepare it before the fieldwork window.
7 min read
- ISO 9001
- Scoring
ISO 9001 supplier evaluation: meeting clause 8.4 with an approved supplier list
Criteria, a deterministic scorecard, corrective actions and the approved supplier list: clause 8.4 evidence in one place.
5 min read
Free tools, templates and reference
Run a free OFAC sanctions check
Check a vendor or its owners against the US Treasury SDN list in seconds. No account needed; possible matches are shown with their match strength for you to review.
View a sample audit-ready vendor report
The PDF an auditor or customer receives: every score with its working, the evidence reviewed, framework coverage and audit-trail citations. Built from fictional demo data.
Vendor onboarding & vetting checklist (Excel, .xlsx)
Every onboarding and vetting check with why it matters, the evidence to keep, an owner and a status column. US and international sections. No sign-up.
Vendor risk management glossary
TPRM, fourth parties, sub-processors, SCCs, SOC 2 Type I and II, bridge letters, W-8BEN-E and more, each defined in a paragraph.
The process in these guides, as a product
VendorVett is the vendor inventory, questionnaire, scoring and evidence record the guides describe — built for small and mid-sized businesses, free to start.