6.3.1. Vendor Assessment and Selection

💡 First Principle: Before sharing data or granting access to a third party, you must evaluate their security posture to ensure it meets your requirements. Due diligence before signing a contract is far cheaper than breach remediation after a vendor compromise.

Vendor assessment methods:

• Penetration testing — testing the vendor's defenses (if contractually permitted). Provides the most realistic assessment but is invasive and requires significant planning and legal coordination.
• Right-to-audit clause — contractual right to audit the vendor's security controls directly or through a third party. Essential for high-risk vendors handling sensitive data.
• Evidence of internal audits — requesting the vendor's internal audit reports and remediation tracking. Shows whether the vendor takes its own security seriously.
• Independent assessments — SOC 2 Type II reports, ISO 27001 certification, or other third-party attestations. These are the most common and practical assessment method because the vendor has already been evaluated by independent auditors.
• Supply chain analysis — understanding the vendor's own third-party dependencies (fourth-party risk). Your vendor's data may be processed by their vendors — you need to understand that chain.
• Questionnaires — standardized security questionnaires (SIG, CAIQ) assessing the vendor's controls across domains like encryption, access control, incident response, and business continuity.

Due diligence — the investigation performed before entering a vendor relationship. Includes financial stability (will the vendor exist in two years?), security posture, regulatory compliance, incident history (have they been breached before?), and business continuity capabilities. Due diligence should be proportional to risk — a cloud provider storing your customer data warrants deeper investigation than an office supply vendor.

Conflict of interest — identifying situations where vendor interests might conflict with security objectives (e.g., a penetration testing firm that also sells remediation services, or a vendor that both assesses and provides the controls being assessed).

⚠️ Exam Trap: A SOC 2 Type II report covers both the design of controls AND their operating effectiveness over time (typically 6-12 months). A Type I report only covers design at a single point in time. Type II is more valuable because it proves controls actually work consistently.