Your organization is considering a new software provider. The vendor sends a security report, answers a questionnaire, and says the product is widely used.
That information can help. It does not, on its own, answer the business question:
Is this service an acceptable risk for the way we plan to use it?
The answer depends on what the provider will do, what information it will handle, how much access it needs, and what happens if the service fails or is compromised.
A useful vendor review turns evidence into a decision that the business can explain and revisit.
Start with the relationship
Before requesting a stack of documents, describe the proposed use:
What business process will the vendor support?
What information will it store, process, or access?
Will it connect to your systems or administer them?
How important is the service to customers, employees, or operations?
What would happen if it were unavailable?
Are there contractual, privacy, or regulatory requirements that apply?
The same vendor may present different risks for different uses. A public marketing tool with no access to internal data deserves a different level of scrutiny from a provider that manages employee identities or processes sensitive customer records.
This context also helps the security team ask focused questions rather than send every supplier the same lengthy questionnaire.
Use risk to set the depth of review
A practical review can begin with three questions:
QuestionWhat it helps determineHow sensitive is the information involved?The potential impact of unauthorized access or lossWhat access will the supplier have?The systems and actions that could be affectedHow dependent are we on the service?The operational impact of an outage or failed transition
A higher-impact relationship may justify a deeper review, contract negotiation, and more frequent reassessment. A lower-impact relationship may need a shorter review and a documented owner.
Risk tiering is a way to use limited time well; it is not a reason to ignore a material concern that appears in a lower-tier review.
In July 2026, NIST published a supplier due-diligence guide covering areas such as supplier resilience, foundational cybersecurity practices, provenance, and supply-chain relationships. It offers a useful starting point for deciding what information to investigate. CSRC
Read the evidence for the service you are buying
A vendor may provide an independent assurance report, a certification, a security questionnaire, or other supporting material. These can be valuable, but reviewers should check the details.
For a SOC 2 report, for example, consider:
Does the report cover the product and services you plan to use?
What period does it cover?
Is it a Type 1 report about controls at a point in time, or a Type 2 report that includes a period of testing?
Were exceptions identified, and are they relevant to your use?
Are important service providers or functions outside the report’s scope?
Does the report identify responsibilities that the customer must perform?
A report can provide evidence about selected controls within its stated scope. It is not a guarantee that every product, feature, subcontractor, or customer configuration is secure.
If a report is confidential, obtain and share it through an approved process. A nondisclosure agreement may be necessary; make sure the person accepting it has the appropriate authority.
Identify what your business must do
Many cloud services share security responsibilities between the provider and the customer. Even when the vendor protects its infrastructure, your organization may still need to configure access, review users, enable available security features, or decide what data to upload.
For each important responsibility, name an owner and decide how it will be verified.
Example responsibilityBusiness questionUser accessWho approves access and removes it when someone leaves?Administrative privilegesWho can change security settings, and how are those changes reviewed?Data handlingWhat information may be uploaded, and who approves exceptions?MonitoringWho reviews alerts or unusual activity?RecoveryWhat can the vendor restore, and what must your organization maintain?Vendor accessWhen can supplier staff access your environment, and how is access removed?
A strong vendor report cannot compensate for a customer account configured with excessive privileges or abandoned administrator accounts.
Review the contract and the exit
Security and operations teams should involve procurement and legal colleagues where appropriate. Depending on the relationship, useful questions include:
How and when will the provider notify you of a security incident?
What availability and support commitments apply?
Which subcontractors may handle your data?
How will information be returned or deleted when the service ends?
Can you export data in a usable format?
What assistance is available during a transition?
How will material changes to the service or its security practices be communicated?
The best time to consider an exit is before the service becomes deeply embedded in a critical process. A low-cost product can become expensive to replace if data, integrations, and operating procedures are difficult to move.
Record a decision, not just a score
At the end of the review, the business should be able to explain:
The intended use and business owner.
The evidence reviewed and any missing information.
The most significant risks and their potential impact.
Required actions before or after implementation.
The person authorized to accept any remaining risk.
The next review date and events that would trigger an earlier review.
A decision might be to proceed, proceed with conditions, delay while a gap is addressed, or select another provider. If the evidence is incomplete, record that uncertainty rather than treating an unanswered question as a passed control.
Keep the review alive
A vendor relationship changes over time. A product may gain access to more sensitive data, add integrations, change ownership, introduce subcontractors, or become more important to daily operations.
Review the relationship again when there is a material change, an important incident, a renewal, or a scheduled reassessment. Confirm that access still matches the business need and that assigned actions have been completed.
A good vendor security program does not require perfect documentation from every supplier. It requires a consistent way to understand the relationship, evaluate evidence, assign responsibilities, and make decisions proportionate to the risk.
Up In Mars can help your organization build a practical vendor-review process, identify high-impact suppliers, and turn assessment findings into an actionable improvement plan. Explore our security services or get started.