Supplier security due diligence
Understand the evidence
behind a supplier.
Collect the right security documents, organise what they say and record the questions that still need an answer. Practical support for a supplier review, with your team making the final decision.
Discuss a supplier review ↗What you receive
A review you can follow.
- 01An evidence register with sources, scope and document dates
- 02A completed draft of your agreed assessment template
- 03Missing evidence, exceptions and follow-up questions
- 04A concise handover for your responsible reviewer
Who it suits
Small businesses reviewing a new supplier, software teams organising assurance records, and consultancies needing help with a defined evidence pack.
What we look at
Documents might include a security questionnaire, relevant policies, an ISO certificate or a SOC report. We check whether the evidence relates to the supplier and service being reviewed, and record where it does not answer the question.
What to send first
Start with the supplier's name, the service you use, your template and deadline. Do not send restricted reports or personal data in the enquiry. We agree authorisation and a secure sharing route before reviewing confidential material.
Fictional example
A certificate is
the starting point.
A supplier provides a certificate, but its stated scope does not clearly cover the product you use. The review records that uncertainty and asks for clarification rather than marking the supplier as approved.
An illustrative example, not a real client or supplier assessment.
Explore the sample review ↗How it works
Keep the decision grounded.
- Agree the service, questions and review boundaries
- Collect and index authorised evidence
- Draft the assessment and flag open points
- Hand over for your team's approval
Your team retains the decision
This is evidence and assessment preparation support. It does not provide a certification, independent audit opinion, legal advice or a guarantee that a supplier is secure. Specialist issues are referred to the appropriate owner.
Before we start
A few useful answers.
Can you obtain restricted supplier reports?
Only through an authorised route agreed with you and the supplier. Any NDA or access declaration needs the appropriate approval. We do not bypass trust-centre controls.
Can you use our existing assessment template?
Yes. We can work to an agreed template and record the source behind each draft answer. Items that cannot be supported remain open for your reviewer.
How long does a supplier review take?
That depends on the questions, evidence and supplier response time. We agree a delivery date after seeing the scope. Missing third-party documents can affect completion.
Will you approve or reject the supplier?
Your responsible owner makes that decision. The handover gives them a traceable evidence record, open questions and any agreed next steps.
Talk through the task
Need a hand with this?
Send a short outline and your deadline. We can confirm whether the work fits before you commit.