Vendor security assessment, explained.

What a vendor security assessment is: checking what a supplier says against what someone tested

One Tier-1 renewal, from procurement's form to the next review date

1. Procurement sets the tierA form asks what data the vendor holds, whether it touches regulated records, what access it has and how hard it is to replace. The answers place it in a tier, and Tier 1 gets the closest review. In the example, the form arrives on September 24.
2. The vendor sends evidenceQuestionnaire, SOC 2 report, penetration test, policies, certificates and agreements. In the example, they arrive on September 26, with one letter missing.
3. The answers meet the evidenceEach answer is compared with the independent tests, gaps are listed, and the risk left over gets a reasoned number. This step is what this guide is about.
4. People decide, with conditionsThe analyst signs, and a senior person co-signs high risk. Requests go to the vendor and clauses to procurement. In the example, both signatures land on October 7.
5. The vendor is watchedExpiring reports, retest letters, notices from the vendor's own host, and a full review on the tier's schedule. In the example, the next one is October 2027.

The companies, people and figures in this example are fictional.

Why a clean audit opinion can sit beside a High rating, and three more surprises

SIG, SOC 2, CUEC, residual risk: four words this work runs on

You will also meet GxP, the quality rules for regulated work, such as good clinical and good manufacturing practice. Fourteen terms are defined in the summary and glossary.

What is in a vendor's evidence pack, who wrote each page, and how far each one takes you

In shortEach document answers a different question, and they differ most in who wrote them. A questionnaire is the vendor's own account. A SOC 2 Type II report and a penetration test come from outsiders, though the vendor chooses the scope. A certificate says a management system met a standard, within a stated scope. No single document covers everything, so the skill lies in knowing which one can prove what.

SIG Core, SIG Lite and CAIQ: which questionnaire a vendor sends, and why the counts disagree

The SIG is a licensed product of Shared Assessments, so its full question list is not public. Guides quote different counts for SIG Core (855, 825 and 627 in three we read) and for SIG Lite (126, 150 and 128), and we did not read a count from Shared Assessments itself.5 Scope matters more than the total, because the 2026 edition comes with scoping presets, Lite, Core and Detail, and added no new risk domains. It maps the AI questions to ISO 42001.6 Our example's 627 questions are that sample's figure and should not be taken as the size of any real form.

CAIQ is the Cloud Security Alliance's questionnaire. Version 4.1, released in January 2026, has 283 questions, and the alliance's STAR registry accepts v4.0 and v4.1 submissions until December 2027.7

Two questionnaires from two vendors may ask the same thing differently, so a team usually maps every answer to its own control list. That mapping is where much of a review's reading time goes.

Why a drug maker's vendor list looks different from a bank's: patient diaries, GxP records and plant links

In shortA breach at a pharma supplier can expose patients, and it can also put the integrity of trial or batch records in question, which reaches a drug application. So tiering looks at more than data sensitivity: does the vendor touch regulated records, reach your network, or take a year to replace? Tiers decide how much evidence you ask for and how often. We found no public count of how many vendors a drug maker runs, so count your own.

In clinical work, the sponsor, the company running the trial, keeps responsibility whatever it hands over. ICH E6(R3) says a sponsor may transfer trial activities to a service provider, but "the ultimate responsibility" for them stays with the sponsor, and the sponsor assesses the provider's suitability.8 The European Medicines Agency's guideline on computerized systems in trials says the same of data: tasks can be delegated, "but nevertheless the full responsibility for the data integrity, security and confidentiality resides with" the responsible party.9 A cloud platform's security therefore counts as part of the trial's quality.

Six kinds of pharma supplier, and what makes each one a security question

The tiers are our illustration, drawn from the fictional portfolio in Part B. Your own rules set them.

What a reassessment schedule usually looks like, and what should override it

No rule we read fixes the interval. A common pattern, used in our example, is every 12 months for Tier 1, 24 for Tier 2 and 36 for Tier 3, with triggered checks in between. The triggers matter as much as the calendar: a new report, an expiring certificate, a change of hosting, a new sub-processor, or a notice from the vendor.

NIST, the US standards institute, asks for the same two habits in general terms in its Cybersecurity Framework 2.0: know your suppliers "by criticality" and plan due diligence before you sign, then keep watching over the relationship.10

The rules behind a pharma vendor review in November 2026: NIS2, HIPAA, GDPR, Part 11, Annex 11 and ICH E6(R3)

In shortNo law names a questionnaire or a score. They set duties, and you choose the method. NIS2 makes supply chain security a legal duty for many EU drug and device makers, in the member states that have transposed it. HIPAA's proposed rewrite would demand yearly written proof from business associates, though it is not final. GxP guidance keeps the regulated company responsible for what its IT service providers do. And no rule lets you certify a product for Part 11 or Annex 11.

Nine rules a vendor review answers to, with their status today

FDA's Computer Software Assurance guidance often comes up here. Its scope is software in medical device production and quality systems, so it does not govern a drug maker's vendor review.33 The EU's January 20, 2026 proposals would bar NIS2 entities from using components from designated high-risk suppliers in key assets.34 They are still proposals: on November 3, 2026, Parliament's file on the Cybersecurity Act 2 read "Awaiting committee decision".15

How to read a SOC 2 report in the order reviewers use: opinion, scope, carve-outs, your controls, exceptions

In shortStart with the opinion and its period, then check that the system you buy is in scope and which categories were examined. Find what was carved out. List the controls you are assumed to run. Only then read the test results for exceptions, and treat management's response as unaudited. Section numbers vary by report, so look for the content.

Read the auditor's opinion first, and why it is only the start

A licensed CPA firm performs a SOC 2 examination, and the result is its opinion.1 "Unmodified" means the auditor found that controls were suitably designed and operated effectively in all material respects. A report can carry exceptions and still be unmodified, because an exception on one control may not change the auditor's overall conclusion. In our sample, the auditor writes that the exceptions "did not result in a modification of this opinion". A qualified, adverse or disclaimed opinion deserves a direct conversation with the vendor.

Five categories, and the one that is often missing for patient data

The American Institute of CPAs (AICPA), whose standards govern SOC reports, names five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy.3 A report need not cover all five, and the vendor chooses its scope. In our sample, Processing Integrity and Privacy are out, on a platform holding patient diaries. Your own data decides whether that matters. On a clinical platform, processing integrity and privacy are both worth asking about.

In and out are from the fictional Velunda report. The questions are ours.

Carve-out or inclusive: who examined the vendor's host

Many software vendors run on someone else's cloud. Under the carve-out method, the report excludes the controls of that host, which auditors call a subservice organization. Under the inclusive method, it includes them. After a carve-out, you need the host's own report. Keep one copy on file and reuse it, since many of your vendors may share a few hosts. Section 10 returns to this.

Complementary user entity controls, the part of the report addressed to you

The report lists what the auditor assumes each customer does: remove your own users promptly, review their access each quarter, require MFA through your identity provider, review audit-trail reports. Our sample lists seven. They are easy to file and forget. A better habit is to match each to a named owner and a status on your side, because if you are reviewing access once a year and the assumption says quarterly, the audit result does not fully apply to you.

Period, bridge letters and the gap nobody tested

A Type II report covers a stated period, and everything after it is untested. A bridge letter, or gap letter, is the vendor's management saying nothing significant changed.

A CPA writing on these letters says the AICPA's SOC guidance does not cover them, and that most cover no more than three months.36 A compliance software vendor calls three months the industry standard.2 The limit is market practice, and we did not read the AICPA's guide to confirm that it is silent. So a bridge letter covering six months asks you to trust an unaudited statement for half a year, and teams often press for the next report instead.

How to compare a questionnaire answer with an audit test, and what 3 of 25 can and cannot tell you

In shortA contradiction needs two passages that cannot both be true for the same scope and the same time. Many apparent ones are timing gaps: the test covered last year and the answer describes today. Either way, the fix is the same: ask for dated proof. Auditors test samples, so read small numbers with care: zero exceptions in 25 still allows a real failure rate of up to about 11%.

In our fictional cases, four answers line up against a test or a contract. Each row names both passages.

When a contradiction is really a timing gap

Look at the backup row. The answer is dated September 2026. The exception sits in a period ending March 2026, and the failure ended on September 4, 2025. Both statements could be true: a real gap, later fixed. Management says so, and gave the auditor no evidence. So you should write "contradicted by the evidence on file", ask for dated proof, and avoid saying the vendor lied. That wording protects your team, and a person answering honestly will have the proof on hand.

An older exception still tells you something. The answer says "all", while the report shows the control was absent for part of the period. If the vendor's answer carried no comment about the history, ask why the person filling it in did not know, or did not say.

Scoring a domain by its weakest independent test, and the limits of that

Many teams score each domain from the questionnaire and from each independent test on a 0 to 100 scale. A simple rule is to take the weakest independent test as the evidence score. In the example, encryption reads 98 from the questionnaire, 60 from the SOC 2 test and 52 from the penetration test finding on old versions of TLS, the protocol that protects data between systems, so the evidence score is 52. The gap is 98 − 52 = 46 points. The scale is a company's judgment and no standard defines it; its use is to rank where to read first.

The arithmetic of a sample: 3 of 25 is a range

Auditors test samples, so 3 of 25 is 12% of the sample. If those 25 were drawn at random, the exact 95% range for the true rate runs from about 2.5% to 31%. For 2 of 10, it runs from about 2.5% to 56%. Those are our calculations, and an auditor's sample may be chosen on judgment and need not be random, so treat them as a sense of scale.

The practical point is that "only 2 of 10" says little about how many backups were affected, which is why a full export beats a smaller sample.

Claims no test covers: audit trails, system validation, privacy and AI use on a GxP platform

In shortA SOC 2 report examines security controls against general criteria. Whether a clinical system is validated, keeps audit trails to Part 11 or follows your protocol lies outside what it is written to test. Privacy is often out of scope. AI use of your data is usually only a questionnaire answer. These gaps are the ones a pharma team must fill with other evidence, and they are where a quality group should join the review.

An audit trail is a system's time-stamped log of who created or changed a record. Validation is documented proof that a system works as intended. Our sample's vendor says its audit trail "is always on and cannot be disabled by any user, including administrators". That may be true. Nothing in its pack tests it.

FDA's guidance lists audit trails, validation, access controls and record retention among what a regulated company should weigh at a provider, and says the company "may consider reviewing the IT service provider's documentation" where the provider did the validation.4 EMA is firmer: if the vendor's validation documentation is insufficient, or the sponsor cannot rely on the vendor to provide it, "the responsible party should validate the system".9

Part 11 itself asks for validated systems, secure computer-generated time-stamped audit trails and authority checks.29 A vendor's statement that it meets those clauses is a promise about your future inspection. It belongs on the claim side of the page until a validation summary, a qualified audit or your own testing sits beside it.

Four questions that fill the gaps a SOC 2 report leaves on a regulated system

Draft Annex 22 is still a draft. EMA's workshop report says consultation comments supported allowing these models in GMP applications and that the drafting group has discussed widening the scope, with no revised text published.37

Eight ways a vendor security review goes wrong, and what a real hearing showed about one missing control

In shortReviews usually fail in ordinary ways: reading the opinion and stopping, trusting a management response, accepting a certificate without its scope. We found no FDA warning letter that turns on a security questionnaire, and regulators speak here through guidance. The public record on breaches shows why basic controls deserve a second look: in testimony to Congress, one parent company's chief executive said a remote access portal had no multi-factor authentication.

What the 2024 Change Healthcare testimony says about MFA on a remote portal

Change Healthcare is a health care clearinghouse and a subsidiary of UnitedHealth Group.12 UnitedHealth Group's chief executive told a House subcommittee on May 1, 2024 that on February 12 "criminals used compromised credentials to remotely access a Change Healthcare Citrix portal", and "the portal did not have multi-factor authentication".38 HHS later noted that its breach report, filed July 19, 2024, listed 100 million people as an approximate figure, with the company still determining the number.12

We cite that record for one lesson. Multi-factor authentication on remote access is a common questionnaire item, and a single missed system can sit behind a confident general answer. That says nothing about what any questionnaire in that case said; the testimony does not address one. It is the reason our example treats "100%" with care.

The same report gives 31% for full remediation of weak passwords and excessive permissions, with half of findings taking almost eight months. For known exploited vulnerabilities, the median time to full resolution went up to 43 days, from 32 the year before.39 A vendor promising "high findings in 30 days" is therefore promising better than that median, so ask for evidence.

How vendor residual risk gets a number: inherent 88, base 34, seven findings, High 64

In shortRate how much harm the vendor could do before any controls, take credit for controls you have evidence for, then add points for each open finding, with a reason for each. No regulator prescribes these numbers, so yours should be written down and applied the same way each time. The number supports a decision. The decision belongs to a person, who accepts the remaining risk by name.

Take one worked rating from our fictional case. Inherent risk comes from the procurement form: patient data including protected health information in US diaries (+30), GxP trial data supporting submissions (+22), 14 live studies and about 38,000 participants (+18), and 9 to 12 months to replace (+18). That adds to 88, which is Critical on this company's scale. Vendor controls with evidence bring the base to 34.

Seven open findings then add 30 points: 34 + 9 + 8 + 4 + 3 + 2 + 2 + 2 = 64, High. If every condition is met, the score returns to the base: 34, Moderate.

Who accepts the risk that is left, and why the name matters

Someone has to accept what remains, and that person should have the authority to do so. Many programs set two signatures for High or Critical: the analyst who did the work, then a senior risk owner. Business owners want the system renewed, so they should see the conditions while someone outside their line signs. When a vendor will not fix a finding, a written acceptance names who accepted it, for how long and why. Every assessment file should let a reader see that sentence three years later.

Fourth-party risk: when nine of your vendors run on one cloud host

In shortYour vendor's suppliers are your fourth parties, and you have no contract with them. A hosting provider or an email tool can sit under dozens of your vendors. So track who runs on whom, reuse the host's report, and when a host sends a security notice, check every dependent vendor at once. Rules are also starting to look at where those suppliers sit.

Verizon's yearly Data Breach Investigations Report counts three kinds of third-party relationship: a flaw or back door in a vendor's product, a vendor holding your data, and a vendor connected to your environment.39 A SOC 2 carve-out speaks to the second kind. EMA's guideline asks that sub-contracting and your oversight of it be written into agreements, and says data jurisdiction questions should be settled in the contract before you use a cloud solution.9

Three kinds of vendor relationship, and what to ask about each

In the US, 28 CFR Part 202 adds a location question for bulk sensitive personal data: who owns the vendor, and from where its staff can reach the data.13 The EU's proposed rules on high-risk suppliers would add another, if they pass as proposed.34

Third-party breaches in 2026: what Verizon, IBM and Gartner publish, and what nobody publishes

In shortVerizon's 2026 report puts third-party involvement at 48% of breaches, up from 30% a year earlier. That figure covers more than vendors who hold your data, and Healthcare's own share is 32%. IBM's average breach cost for health care is $6.64 million, on a modeled basis. Nobody publishes how many vendors a drug maker runs, what a review costs or how often answers fail a test, so those numbers have to come from you.

IBM's global average across all industries is $4.99 million, and the US average is $11.5 million.45,41 These reports count all causes of breach, so read them for scale only.

The figures no one publishes, and what to count instead

What AI can and cannot do in a vendor review, and what regulators have said

In shortSoftware can read a 600-answer form and a 100-page report, cite each passage and line up answers against tests. It cannot test a control or carry the risk. We found no peer-reviewed study measuring AI on this reading, so judge any tool on your own past files. Keep a person on every decision, and hold the tool to the same questions you ask any vendor.

Four limits to keep in view when AI reads vendor evidence

What FDA, the EU and industry guidance say about AI near this work

• FDA's draft on AI for regulatory decision-making (January 2025, still a draft on FDA's page) concerns AI producing information to support decisions about the safety, effectiveness or quality of drugs.47 Our reading is that an internal vendor review falls outside it. The same draft can matter for a vendor whose AI feeds your submission.
• EU AI Act. Regulation (EU) 2026/1744 moved the high-risk dates: Annex III to December 2, 2027, and Annex I to August 2, 2028.17 Check your vendors' AI features against those lists, and ask them for their classification.
• Draft EU GMP Annex 22. Applies to AI in critical GMP uses, still a draft, as section 07 says.19,37
• ISPE GAMP AI guide (July 2025), from the pharmaceutical engineering society: a risk-based framework for AI-enabled computerized systems in regulated life sciences, including supplier responsibilities.48
• Data integrity. Whatever reads the evidence, the records you sign should stay attributable and complete: who decided, on what passage, and when.

How pharma IT risk teams run a Tier-1 review today: who does what, and where about 20 hours go

In shortProcurement starts it, a third-party risk analyst carries it, and privacy, quality, identity and the business owner each hold a piece. The largest block of time is reading and mapping documents to your own controls. We found no published study of the hours, so the split below is an estimate for you to replace with your own count.

Analyst, head of IT risk, privacy, procurement: who touches one renewal

From procurement's form to a signed decision, with the hand-offs

Three ways pharma teams staff vendor reviews, and what each one trades

October 7: Velunda says every backup is encrypted, and page 52 of its audit report disagrees

In shortThis is the example from the top of the page, inside the product. Priya Ranvelle, a third-party risk analyst at Northwind Bio, has a decision due in two days on a platform running 14 studies. The agents have already read 611 answers and 112 pages. A radar shows where what the vendor says and what the evidence shows part ways, and each gap opens onto both passages.

1

Priya's list says five assessments need her, and Velunda's is due in two days

Velunda Trial Cloud is Tier 1 and in analysis. Inherent risk is Critical 88, residual is High 64, 9 of 10 documents are in and one is missing, and the decision is due October 9. The renewal is November 15.

Fourteen vendors show recent activity. Another 472 are in monitoring, all quiet, so the 486 in scope never become a reading list.

2

The security radar plots what Velunda says against what the evidence shows

Ten domains sit around the circle. Blue is the questionnaire, green is the weakest independent test, and the dashed ring is Northwind's bar for Tier 1, 75. Red marks a contradiction. Two white marks show claims nothing tested.

On the right, the contradiction finder sorts everything by the size of the gap. Encryption reads 98 from the questionnaire. The SOC 2 test gives 60 and the penetration test 52.

3

One click opens the auditor's exception, word for word

SIG G.1.2 says all data at rest, including database backups in both hosting regions, is encrypted with AES-256. The SOC 2 test found 2 of 10 sampled backup sets from the secondary region without encryption at rest before September 4, 2025. The passage sits on page 52, highlighted, beside the finding.

The penetration test adds a related item: old TLS versions still accepted on the file-transfer service.

4

The second contradiction: MFA for 100% of privileged accounts, except 3 of 25

Answer H.4.2 says MFA is enforced for all privileged access. The SOC 2 test of CC6.1, on page 48, found 3 of 25 sampled privileged accounts without it. The finding names what would close it: an identity provider policy export dated after February 2026, covering every privileged account.

This finding adds 9 points to residual risk, the most of any.

5

What management says goes on the record as a claim

Management's response says earlier backups were re-encrypted by November 2025, and that MFA reached the three accounts in February 2026. Neither was evidenced to the auditor. The fixes may be real, which is why the finding asks for dated proof and avoids calling the answer false.

The SOC report reader quotes exceptions word for word and keeps management's replies apart from what was tested.

Inside Velunda's workspace: seven findings to act on, the untested claims and the seven controls on Northwind's side

In shortThe workspace holds the evidence pack on the left, the findings in the middle and the source document on the right, so any statement can be checked where it stands. Seven findings need action. Two of them are claims no independent test covers, and one is a stale report. Below those sit a one-off that was noted and a carved-out host resolved by reusing a report on file. The tab "Our side" holds the controls the auditor assumed Northwind runs.

Open penetration test findings, and a report six months old

Two high findings remain open from the July test: a site user could read another site's patient diaries by changing a record identifier, and the file-transfer service still accepts TLS 1.0 and 1.1. Northwind's standard asks for a fix and retest within 30 days. The retest is planned for November, after the renewal, so the decision carries a dated retest letter. The SOC 2 period ended March 31, and the bridge letter was never received, which adds another finding.

Audit trail and Privacy: two claims the SOC 2 never looked at

Seven controls Velunda's auditor assumed Northwind runs

The SOC report reader lists each complementary user entity control, and each is matched to Northwind's own framework with a named owner. Five are in place and two need action. Access review for this system runs once a year where the report assumes quarterly; that one goes to Dana Okafor, the identity and access lead. Audit-trail review runs in 9 of 14 studies; that one goes to Dr. Maya Chen, the clinical operations business owner.

From High 64 to a co-signed approval: the reasons, the requests, the clauses and who accepted what

In shortThe risk rater shows why inherent risk is Critical and what moves residual, point by point. Ticking a condition shows its effect. The writer drafts one request per finding and one clause per domain. Priya chooses and signs. Residual is High, so Omar Haddad, Head of IT Risk and Compliance, co-signs. Nothing goes to the vendor until the analyst sends it.

1

Why High: a reason beside every point

The gauges read 88, 64 and 34. Below them, four factors explain the 88, and seven lines explain how a base of 34 becomes 64. Each carries its reason and a citation back to the page behind it.

2

Tick a condition, and watch the score

Omar asked to see the page behind every point, and the same list answers the next question: what if the vendor delivers? With every box ticked, the middle gauge falls to 34, Moderate. An analyst can test which condition matters most before writing any of them into a contract.

3

Seven requests to Velunda's CISO, each tied to its passage

The request letter to Marta Lindqvist lists one item per finding, with the evidence that would close it and the document it relates to. Priya reads it and sends it herself.

On item 3, the 14-day window is for the dated fix plan. The retest letter itself is due December 15.

4

Clause wording procurement can use as written

Sam Patel, the procurement category manager, asked for wording, so he gets it, from the approved library, one clause per domain with a finding. The incident notice clause asks for 24 hours, then an assessment within 72 hours and a final report within one month. Those are Northwind's own terms for its suppliers.

5

Priya chooses, and the conditions travel with the decision

The options run from approve to do not approve. The recommendation is to approve with conditions, seven of them, tracked to closure. Full reassessment is October 2027. A triggered check on December 15 follows the retest letter.

Instead of a request, an analyst can choose "Accept with note" on a finding, and a Tier-1 high finding needs the Head of IT Risk to confirm that acceptance. So each accepted risk has a person's name and a reason on it.

6

Two signatures, and the same-day record

Priya signs. Omar Haddad co-signs for the High residual. The requests go to Marta Lindqvist and the clauses to Sam Patel, and the reassessment is booked. The activity trail keeps every step, for people and agents alike, with decisions and rule changes kept seven years.

Velunda's ISO 27001 certificate also runs out on November 30, 2026, two weeks after the renewal. It raises no finding on these screens; an analyst would still want the renewed certificate on file. October 21 is 14 days from the signed decision, by our count.

Beyond one vendor: other contradictions, unread evidence, host notices, the portfolio view and the six agents

In shortThe same method runs across 486 vendors. It finds a different kind of gap on each: sub-processors on one, shared admin accounts on another, a model trained on your queries on a third. It tracks who runs on whom, and the calendar comes from the decisions. Rules live in settings and are versioned. Six agents do the reading and drafting; two people sign.

Three more vendors, three different gaps

Reassessment calendar, host notices and who runs on Nimbrel

The portfolio: throughput, residual risk by tier and where findings cluster

Your tiering, evidence rules, cadence and approvals, set as versioned settings

The rules the agents apply are settings: what makes a vendor Tier 1, how old a report may be before a bridge letter is asked for, how fast a high finding must be fixed, whether ISO 27001 can stand in for SOC 2 on lower tiers, and who signs what. Changes are versioned and apply to open assessments.

Six agents read and draft; an analyst and a head of IT risk decide

What goes into a vendor assessment, and what comes out

Systems a vendor assessment connects to

What a missed contradiction and a late renewal cost a drug or device company, and how to find your own number

In shortPublished costs describe breaches and fines, which are large and rare, and they say little about your reviews. The costs you carry every month are quieter: analyst days, renewals signed before the reading ended, conditions nobody tracks, and controls on your side that were never running. Measure those on your last 20 reviews.

Where vendor review costs hide, and how to find your number in a week

Costs a vendor review calculator leaves out: breaches, inspections, findings and trust

Sizing the return on faster vendor reviews: four levers and a calculator you fill in

In shortAnalyst hours can be counted. Risk avoided mostly cannot, so leave it out of the sum and describe it separately. Every default below is an assumption. Change them to your own, and treat a result that only works on the optimistic inputs as a reason to run a pilot before you commit.

Four value levers in a third-party risk team

Vendor review hours and dollars, on your volumes

Which vendors to read first: where a security read pays back soonest

Is your third-party risk team ready to automate reading? Eight scored questions and one to reflect on

In shortPick the answer closest to your team today. Eight questions score 0 to 2, and the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like. A low score points to useful work you can start now.

What to ask a third-party risk software vendor about citations, SOC 2 reading, scoring and your data

In shortBring a hard past pack and watch what happens. These questions test whether a tool reads the evidence, cites what it claims, tells you what it could not determine and leaves decisions with your people. Ask us too. Each question says why it matters and what a strong answer sounds like.

A 10-week pilot on your own Tier-1 evidence: replay ten past packs, then run live renewals beside your team

In shortStart by replaying evidence packs you already reviewed, and measure whether the solution finds what your team found and what it missed. Then run new Tier-1 renewals in parallel. Your people keep every decision. If the numbers do not hold on your own files, you have learned that cheaply.

Eight things to measure in a vendor security review pilot

Vendor security assessment questions, answered

In shortShort, standalone answers to the questions people most often search, as of November 2026. None of this is legal advice.