In short
Vendor due diligence assesses a potential vendor before signing, covering its financial strength, security and privacy controls, compliance, reputation and the data or systems it will access.
Key takeaways
- Vendors are usually tiered by risk, with more scrutiny for critical ones.
- Evidence includes questionnaires, assurance reports and certifications.
- Due diligence continues as ongoing monitoring throughout the relationship.
Where it's tested
ISC: Third-Party & Vendor Risk — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
A service organization's SOC 1 report uses the carve-out method for a subservice organization. What does this mean for the user entity?