The short answer
Assess the specific service, ask for evidence that matches its exposure, and record who accepts the remaining risk.
1. Define what you are buying
A vendor risk assessment evaluates the exposure associated with a supplier and the controls that address it. Before sending questions, describe the service, deployment model, data flow and business dependency. Include pilot projects and free tools when they can access business information. Procurement spend is not a reliable proxy for security exposure.
- Service and legal supplier name; internal owner.
- Data categories, storage locations and retention needs.
- Integration points, permissions and authentication method.
- Impact if the service becomes unavailable or produces incorrect results.
2. Choose a proportionate evidence review
CISA's vendor SCRM template is a flexible starting point, not a mandatory checklist for every supplier. Tailor your questions to what can actually go wrong. Prioritize access, data handling and recovery for a critical SaaS provider; use different evidence for a hardware supplier or an external consultant.
- Check that assurance reports cover the service and relevant period.
- Review access restrictions and account-removal procedures.
- Ask how vulnerabilities are assessed and remediated.
- Identify material subprocessors and changes that need notification.
3. Test continuity assumptions
A recovery document is not the same as evidence of a successful test. Ask what was tested, when, what failed and whether the scope includes the service you use. Compare the supplier's stated recovery objectives with the time your business can tolerate being without the service. If you cannot validate a claim, record that uncertainty rather than marking it green.
Plan for supplier failure as well as short outages. Could you export essential records, switch providers or operate manually? Concentration risk can exist when apparently different vendors depend on the same underlying provider.
4. Review the contract alongside the controls
A technically strong service can still leave important commercial or operational gaps. Ask appropriate legal and procurement reviewers to examine incident notification, data handling, subcontractor changes, termination assistance and audit or assurance provisions. Obligations differ by jurisdiction and sector; a generic checklist is not legal advice.
5. Record the outcome and reassessment triggers
Use a decision record with evidence reviewed, unresolved findings, compensating controls, accountable approver and conditions for continued use. Options include approve, approve with conditions, defer pending evidence or decline. Avoid averaging a severe access-control gap away with numerous low-impact positive answers.
Set a risk-based review schedule and event triggers. A new production integration, additional sensitive data, material incident or critical subcontractor change should prompt a fresh look even when the next scheduled review is months away. Keep the checklist linked to action owners so it remains an operating process rather than an archive.
Sources & further reading
Primary-source guidance informs these articles. Example workflows are illustrative, not regulatory requirements.