A vendor security assessment is the process of measuring the information security risk of outside companies that access your data, systems or premises, before signing and throughout the relationship. It is the core of third-party risk management (TPRM): vendors are sorted into risk tiers, each tier gets proportionate questions and evidence requests, and findings are tied to the contract and a remediation plan.
Key takeaways
- A vendor security assessment measures the risk of outside companies that access your data or systems, before signing and throughout the relationship.
- According to Verizon's 2026 DBIR, breaches involving a third party rose 60% in a year to reach 48% of all breaches.
- Vendors are sorted into critical, high, medium and low tiers; the tier sets the depth of the questions and how often to reassess.
- Questionnaire answers are not taken at face value; they are verified with policy documents, MFA configuration evidence or restore test records.
- Under Article 12 of KVKK, a data controller is jointly responsible for the security measures of any vendor processing data on its behalf.
Why a vendor security assessment matters: your vendors are your attack surface
To see how wide vendor risk really is, look at the supplier list of a typical mid-sized company. There is an outsourced payroll bureau, a software house maintaining the ERP, a cloud CRM, the firm that installed the CCTV cameras and a machine builder that dials in remotely to service equipment. Each one either handles your data or holds a door into your network. However well you harden your own perimeter, an attacker will simply use the weakest of those doors.
The underlying problem with vendor risk is rarely bad intent; it is invisibility. Procurement looks at price and lead time, IT hears about the contract after it is signed, and the person responsible for data protection under KVKK (Türkiye's Personal Data Protection Law No. 6698) has no idea which vendor processes which records. A VPN account created years ago, a contractor whose admin rights outlived the project, a service provider receiving personal data as Excel attachments: none of these appear on anyone's register.
This guide is about assessing your own vendors; the aim is not to send every supplier the same hundred-question spreadsheet, but to look hard at risky vendors and wave the harmless ones through with a light check. If you are on the other side, answering an EU customer's security questionnaire, see our guide to NIS2 supplier requirements. For the clauses that belong in the vendor contract itself, read our data processing agreement guide.
What does skipping a vendor security assessment cost?
Current figures show that vendor-related incidents are now routine rather than exceptional:
According to Verizon's 2026 Data Breach Investigations Report, breaches involving a third party rose 60% on the previous year to reach 48% of all breaches, and only 23% of third-party organisations fully remediated missing or improperly secured multi-factor authentication (MFA) on their cloud accounts. (Verizon 2026 DBIR)
For organisations operating in Türkiye, vendor risk has a regulatory angle too. Under Article 12 of KVKK, a data controller whose data is processed by another party on its behalf is jointly responsible with that party for taking the required security measures. The Turkish Personal Data Protection Authority's 2025 Annual Report shows that in 2025, 2,838 of the complaints it received (22%) concerned the unlawful sharing of personal data with third parties, the second-largest category after unlawful processing.
The bill for a data breach is substantial. IBM's Cost of a Data Breach Report 2026 puts the global average cost of a data breach at a record $4.99 million, up 12% on the previous year. When the incident starts at a vendor, much of that cost still lands on you as customer notifications, investigation and downtime.
In the European Union, the NIS2 Directive has turned this expectation into law. Article 21(3) of the directive requires in-scope entities to take into account each direct supplier's specific vulnerabilities, the overall quality of its products and its cyber security practices, including secure development (NIS2 Directive, EUR-Lex). Businesses in Türkiye are not directly covered by the directive, but as EU customers pass these expectations down through contracts and questionnaires, companies that serve them need to look at their own vendors the same way. The security firm you hire is itself a vendor; what to check when choosing one is covered in our guide to choosing a cyber security company.
How do you run a vendor security assessment in 6 steps?
The six-step vendor assessment sequence below suits an organisation starting from scratch. Every step should leave a document or a record behind, because in an audit or a post-incident review what matters is not saying you assessed a vendor but being able to show it.
- Build the vendor inventory. Start from accounts payable and your contract files to list everyone you pay, then record which data, systems and physical areas each one touches. If you keep a personal data inventory, its recipients section is a ready-made starting point.
- Assign a risk tier. Rate each vendor as critical, high, medium or low based on the sensitivity of the data it sees, how deep its system access goes and how much your operations depend on it.
- Send a questionnaire sized to the tier. A few basic questions are enough for low-tier vendors. Critical vendors need a detailed set covering identity management, backups, incident notification, sub-processors and data location.
- Verify the evidence. Do not accept answers at face value. Ask for the policy document, an MFA configuration screenshot, the latest restore test record, a summary of a recent penetration test report or current certificates. Also ask whether their internet-facing systems get regular vulnerability scanning.
- Tie findings to the contract and a remediation plan. Agree dated fixes for any gaps, and write the incident notification window, audit rights, sub-processor approval and return or deletion of data at exit into the contract.
- Monitor and reassess. Review critical vendors at least annually, and again whenever their scope changes or they suffer an incident. When the relationship ends, close their accounts and access and record that you did.
What should you ask vendors at each risk tier? A control table
Risk tiering is what keeps the vendor assessment workload manageable. The table below summarises how deeply to look at each kind of vendor, which evidence to request and how often to reassess.
| Tier | Typical vendor | Topics to cover | Evidence expected | Reassess |
|---|---|---|---|---|
| Critical | Payroll or HR bureau, hosting and cloud provider, software house maintaining your ERP | Identity and MFA, encryption, backups, incident notification, sub-processors, data location | Policies, configuration evidence, test records, certificate or independent report | At least annually |
| High | Machine servicer with remote access, CRM or SaaS tool, call centre | Remote access method, account management, logging, data protection role | Access procedure, account list, contract clauses | Annually |
| Medium | Web agency, CCTV or security firm, training provider | What data is held and where, passwords and admin accounts | Short questionnaire and data handling statement | Every two years or on scope change |
| Low | Goods supplier with no data or system access | Confirmation that no access exists | Declaration on the purchasing record | On scope change |
You do not need to write the vendor question set from scratch. The ISO 27001 Annex A controls make a good skeleton, and a certified vendor already holds most of the answers. Rather than rejecting uncertified vendors outright, it is usually fairer and more realistic to look for evidence that the controls actually work.
Three issues cause trouble with critical-tier vendors again and again: vendor staff connecting to your systems through shared rather than named accounts, multi-factor authentication switched on for only some accounts, and data being passed on to the vendor's own subcontractor, sometimes on a server abroad. In that last case Türkiye's cross-border data transfer rules also apply.
3 common mistakes in vendor assessments
The first mistake in vendor assessments is treating the questionnaire as the assessment. A form that is filled in, filed and never read will not protect you after an incident; if anything it proves you knew about a risk and did nothing. Each answer needs an owner and a decision: accept, remediate or find an alternative vendor.
The second mistake is squeezing the vendor assessment into the moment of purchase. Vendor scope creeps: the agency hired to build a website ends up running the server that stores form submissions. Checkpoints during delivery, of the kind described in our guide to supervising software contractors, belong in the process too.
The third mistake is forgetting the exit from the vendor relationship. A departed vendor's VPN account, shared folder links and cloud admin rights often stay open for months. The approach in our article on file sharing permissions applies equally to external parties.
How Digital Bridge runs vendor security assessments
At Digital Bridge we start vendor security assessments with discovery rather than a template questionnaire. As part of our cyber security consultancy, we build the vendor inventory from finance and contract records, then work with your IT team to confirm technically which accounts, servers and remote access routes each vendor really has. The gap between the list on paper and what is live on the network is usually the first finding.
After discovery we define the tiers and the question set for each one, tailored to your organisation, and run a pilot assessment with a handful of critical vendors. The pilot shows which questions genuinely separate strong vendors from weak ones and which only create paperwork, so the set gets leaner. On the privacy side, our data protection compliance team links processor roles, contract clauses and transfer records into the same piece of work.
For cloud and hosting providers, data location, backups and the exit plan deserve extra attention, and here we draw on our cloud migration and infrastructure consultancy experience. Finally we integrate the vendor review calendar, the vendor register and the access-removal steps into your existing processes and hand them over to your team. To review your wider security baseline, the SME cyber security checklist is a good start, and the rest of the series sits on our Cyber Security & Compliance hub.
Digital Bridge's own SmartFiles business file management product can also hold the vendor register and the evidence you collect. A checklist applied to a folder shows, for each vendor subfolder, which documents are complete and which are missing; missing evidence is requested through an upload link the other party can use without opening an account. External sharing is off by default; when it is switched on, links are valid for 1 to 30 days and every download is written to the activity history.
If you are still choosing a new software or service provider, writing the security assessment criteria into the tender is the cheapest option of all. Our guides to writing technical specifications and choosing a software company cover that stage. You can see all our service areas on the consultancy overview.
Where should a vendor security assessment start?
To start a vendor security assessment, write your five most critical vendors and the data each one touches into a single table; for most organisations that first table is the most valuable output of the whole exercise. If you would like help with tiering, the question set or evidence checks, get in touch with us. After a needs analysis we send a written proposal setting out scope, phases and fees.