ISO 27001 Vendor Assessment Template

Establish that the supplier relationship is owned, documented and reviewed. ISO 27001:2022 Control 5.19 expects a defined process for managing information-security risks introduced by suppliers.

• Is the supplier recorded in the vendor inventory with a named internal owner?

  Evidence: Vendor register entry, owner name, business purpose

• Has the supplier been classified by criticality (e.g. critical / important / standard)?

  Evidence: Classification rationale, data categories processed

• Is there a signed contract or DPA covering information security and confidentiality obligations?

  Evidence: Executed MSA, DPA, NDA

• Are right-to-audit, sub-processor and termination clauses present?

  Evidence: Contract clause references

• Is a review cadence defined proportional to risk (e.g. annual for critical)?

  Evidence: Next review date, reviewer

For ICT services and products, verify that security requirements flow down to sub-suppliers (Control 5.21).

• Does the supplier disclose sub-processors and notify changes in advance?

  Evidence: Sub-processor list, change notification policy

• Are software supply-chain controls in place (SBOM, signed releases, vulnerability disclosure)?

  Evidence: SBOM sample, security.txt, VDP URL

• Is there a documented secure-development lifecycle (SDLC)?

  Evidence: SDLC policy, code-review evidence

Confirm the supplier operates a recognised ISMS and applies baseline technical controls on data you share.

• Is the supplier ISO 27001 certified, SOC 2 Type II audited or equivalent?

  Evidence: Certificate, audit report, scope statement, expiry

• Is access to your data restricted via SSO/MFA and least privilege?

  Evidence: Access policy, MFA enforcement

• Is data encrypted in transit (TLS 1.2+) and at rest (AES-256 or equivalent)?

  Evidence: Encryption statement, key-management policy

• Are backup and recovery objectives (RPO/RTO) defined and tested?

  Evidence: BCP/DR test results

• Is there a documented vulnerability and patch management process?

  Evidence: Patch SLAs, last pentest report

• Are logs retained centrally and monitored for security events?

  Evidence: SIEM coverage, retention period

Where personal data is processed, document lawful basis, location and transfer mechanisms.

• Are the categories of personal data and processing purposes documented?

  Evidence: ROPA entry, DPA Annex

• Is the data hosting region defined and acceptable?

  Evidence: Region list, residency statement

• If data leaves the EEA, are SCCs and a transfer impact assessment in place?

  Evidence: SCC version, TIA document

• Does the supplier support data subject requests within statutory deadlines?

  Evidence: DSR process description

Control 5.20 requires security obligations within supplier agreements, including incident handling.

• Is the breach-notification window contractually defined (e.g. ≤72h)?

  Evidence: Contract clause

• Is a security contact (email / phone) provided and tested annually?

  Evidence: Contact card, last test date

• Does the supplier participate in joint incident exercises if classified critical?

  Evidence: Exercise minutes

Control 5.22 covers ongoing monitoring, review and managed change of supplier services.

• Are SLAs and KPIs reported and reviewed at agreed intervals?

  Evidence: Service-review minutes

• Is a documented exit plan in place (data return / destruction within X days)?

  Evidence: Exit clause, certificate of destruction template

• Has residual risk been accepted by the risk owner and recorded?

  Evidence: Risk register entry, sign-off