Organizations need to understand how a third party protects its systems and data before sharing business information, granting system access, or outsourcing a service. A supplier may claim to follow security best practices, but organizations must evaluate those claims against their requirements.

 

A third-party security assessment helps organizations examine a vendor’s security controls, identify weaknesses, and determine whether the vendor can protect the information and services involved in the relationship.

 

ISO 27036 also provides guidance and requirements for managing information security in supplier relationships. ISO/IEC 27036-2 specifies requirements for defining, implementing, operating, monitoring, reviewing, maintaining, and improving those relationships. A third-party security assessment is one practical way to support that work.

 

This guide provides a practical third-party security assessment checklist aligned with these principles. It covers the questions to ask vendors, the evidence to request, and how to evaluate assessment findings before establishing or renewing a supplier relationship.

 

 

How ISO 27036 relates to third-party security assessments

 

ISO/IEC 27036-2 covers information security across the life of a supplier relationship, from defining requirements through monitoring and review

 

A third-party security assessment supports this process by helping you:

 

• Understand the supplier’s existing security practices and capabilities.
• Compare those practices against your organization’s security requirements.
• Identify gaps before entering into an agreement or expanding an existing relationship.
• Establish what evidence the supplier must provide and how you will validate it.
• Document security responsibilities and expectations for both parties.

 

For example, if a supplier processes customer information on your behalf, you need to understand how it controls access, protects stored and transferred data, handles security incidents, and manages its own subcontractors.

 

Your assessment should reflect the risks associated with that particular relationship. A cloud provider with access to sensitive business data may require more detailed checks than a supplier with no access to your systems or information.

 

Third-party security assessment checklist

 

The checklist below covers common areas of a third-party security assessment and can support an ISO 27036-based approach. ISO 27036 does not prescribe this checklist, so tailor it to your supplier relationships and security requirements.

 

1. Security governance and policies

 

Start by understanding how the vendor manages information security and assigns responsibility for it.

 

Questions to ask	Evidence to request
Does the vendor have a documented information security policy?	Information security policy or policy summary
Who is responsible for overseeing information security?	Security organization chart or role descriptions
How often are security policies reviewed and approved?	Policy review records or approval history
Does the vendor provide security awareness training to employees?	Training policy and completion records
How does the vendor handle exceptions to security policies?	Exception management procedure or sample records

 

What to look for: The vendor should have documented security responsibilities and policies that reflect the services it provides. Check whether policies are approved, reviewed, and communicated to relevant employees.

 

2. Data protection and privacy

 

Determine how the vendor handles information that your organization shares or allows it to access. This is particularly important when the vendor processes customer information, employee records, financial data, or other sensitive information.

 

Questions to ask	Evidence to request
What types of organizational or customer data will the vendor access or process?	Data inventory or service data flow documentation
Where is the data stored, and are there any cross-border transfers?	Data storage and processing locations
How does the vendor protect data at rest and in transit?	Encryption policies or technical control documentation
How are data access and sharing restricted?	Data handling policies and access control documentation
How does the vendor retain and dispose of data?	Data retention and secure disposal policies
Does the vendor have documented privacy responsibilities?	Privacy policy or data processing agreement

 

What to look for: Check whether the vendor’s data handling practices match the information it will receive and the contractual requirements. For example, if the vendor processes personal data, confirm that the relevant privacy obligations and responsibilities are documented.

 

3. Identity and access management

 

Review how the vendor controls access to its systems and the information it handles. Weak access controls can expose organizational data even when other security measures are in place.

 

Questions to ask	Evidence to request
How does the vendor grant, modify, and revoke user access?	Access management policy or procedure
Does it use multi-factor authentication for privileged and remote access?	MFA policy or configuration evidence
How are privileged accounts managed?	Privileged access management procedure
Are access permissions reviewed periodically?	Access review records
How does the vendor manage employee access when someone changes roles or leaves?	Joiner, mover, and leaver procedures

 

What to look for: Access should be based on job responsibilities and limited to what users need. Pay particular attention to privileged accounts, remote access, and access to systems containing your organization’s information.

 

 

4. Vulnerability and patch management

 

Assess how the vendor identifies and addresses weaknesses in its systems, applications, and infrastructure.

 

Questions to ask	Evidence to request
Does the vendor conduct vulnerability assessments?	Vulnerability assessment reports or summaries
How does it prioritize and remediate identified vulnerabilities?	Vulnerability management policy and remediation records
How are security patches tested and deployed?	Patch management procedure
Does the vendor conduct penetration testing where appropriate?	Recent penetration testing executive summary
How are security weaknesses that cannot be fixed immediately handled?	Risk acceptance records or remediation plans

 

What to look for: The vendor should have a defined process for identifying, prioritizing, and addressing vulnerabilities. Review whether findings are assigned owners and whether remediation is tracked. A penetration testing report alone does not demonstrate that identified issues have been resolved.

 

5. Security incident response

 

Understand how the vendor identifies, reports, investigates, and responds to security incidents. The assessment should also establish whether the vendor can notify your organization when an incident affects your data or services.

 

Questions to ask	Evidence to request
Does the vendor maintain a documented incident response plan?	Incident response policy or plan summary
How are security incidents identified and escalated?	Incident response procedures
How will the vendor notify your organization of an incident affecting the service or its data?	Contractual notification requirements or incident communication procedure
Does the vendor conduct incident response exercises?	Exercise records or lessons-learned reports
How does it investigate incidents and document corrective actions?	Incident management procedure or anonymized incident report

 

What to look for: Confirm that the vendor has defined escalation responsibilities and a clear communication process. Pay attention to notification commitments, especially when the vendor handles information or services that are important to your business.

 

6. Business continuity and disaster recovery

 

A vendor’s security posture also depends on its ability to maintain or restore services during disruptions. Assess whether it has plans for incidents such as infrastructure failures, cyberattacks, and other events that could interrupt service delivery.

 

Questions to ask	Evidence to request
Does the vendor have a business continuity plan?	Business continuity plan summary
Does it maintain a disaster recovery plan for critical services?	Disaster recovery plan
How often are recovery arrangements tested?	Test results or exercise summaries
Are backup processes documented and tested?	Backup policies and restoration test records
Has the vendor defined recovery time and recovery point objectives for the service?	Service continuity documentation or contractual commitments

 

What to look for: Check whether the vendor’s recovery arrangements match the service’s importance to your organization. A documented plan is useful, but evidence of testing better indicates whether the arrangements can work as intended.

 

7. Compliance and independent security assurance

 

Review the vendor’s compliance, independent assessments, and relevant regulatory obligations. These can provide additional assurance, but evaluate them in context.

 

Questions to ask	Evidence to request
Does the vendor hold relevant security certifications?	Valid certification and scope statement
Has the vendor undergone an independent security assessment?	SOC 2 report or other relevant assurance report
Which systems, locations, and services are covered by its certifications or reports?	Audit scope and system description
Does the vendor have a process for addressing audit findings?	Corrective action records or remediation summaries
Which legal and regulatory requirements apply to the service?	Compliance documentation or relevant contractual commitments

 

What to look for: Do not treat a certification or assurance report as proof that every security requirement is met. Check its scope, validity period, exceptions, and relevance to the service your organization plans to use.

 

8. Subcontractor and fourth-party security

 

A vendor may rely on other providers to deliver part of its service. These subcontractors can introduce additional security dependencies, especially when they process your organization’s information or support critical functions.

 

Questions to ask	Evidence to request
Does the vendor use subcontractors to deliver the service?	Subcontractor or subprocessor list
What services do these subcontractors provide?	Service and dependency descriptions
Can subcontractors access organizational or customer data?	Data access or data flow documentation
How does the vendor assess subcontractor security?	Third-party assessment policy or assessment summaries
How are security requirements communicated to subcontractors?	Contractual security requirements or supplier policies

 

What to look for: Identify subcontractors that can access sensitive information or affect service delivery. Understand how the primary vendor evaluates their security and remains accountable for the services it provides.

 

Applying ISO 27036? See our guide on how to implement ISO 27036 in your supplier security program.

 

How to use the third-party security assessment checklist

 

Sending a questionnaire is only one part of an assessment. You also need a consistent way to scope the review, evaluate responses, and document the outcome.

 

1. Tailor the checklist to the vendor

 

Identify what the vendor will provide and what access it needs. A company providing office cleaning services does not require the same security assessment as a cloud provider processing customer records.

 

Consider:

 

• The sensitivity of information the vendor will access.
• Whether it needs access to internal systems or networks.
• How important the service is to business operations.
• Whether it relies on subcontractors.
• The potential impact of a security incident involving the vendor.

 

Use this information to select the relevant checklist sections and determine how much evidence you need.

 

2. Send questions and request supporting evidence

 

Ask the vendor to complete the relevant questions and provide supporting documents. Avoid relying entirely on yes-or-no answers. A vendor may answer that it uses encryption, for example, but you still need to understand which data and systems the control covers.

 

You can request policy summaries, certification documents, independent assessment reports, and other relevant evidence. Where information is unclear, follow up with specific questions or arrange a discussion with the vendor’s security team.

 

3. Evaluate responses against your requirements

 

Review the answers and evidence to determine whether the vendor meets your security requirements.

 

Record:

 

• Requirements the vendor meets.
• Requirements it partially meets.
• Requirements it does not meet.
• Questions that remain unanswered.
• Evidence that is missing, outdated, or insufficient.

 

Avoid treating every missing document as a confirmed security failure. It may indicate that the vendor needs to provide clarification or alternative evidence.

 

4. Record findings and decide how to proceed

 

Document the assessment results and identify the issues that need attention. Consider their potential impact on your organization, the vendor’s ability to address them, and whether additional safeguards are needed.

 

Possible outcomes include:

 

• Accept: The vendor meets the applicable security requirements.
• Accept with conditions: The vendor can proceed if specified actions or safeguards are completed.
• Request further evidence: The assessment is incomplete, and additional information is needed.
• Reject or defer: Significant security gaps remain unresolved, or the vendor cannot meet the required conditions.

 

Record the reasoning behind the decision, along with any conditions, responsible owners, and agreed deadlines. This gives procurement, security, and business teams a clear basis for approving or declining the relationship.

 

How CyberArrow supports third-party risk assessments

 

Managing vendor questionnaires, reviewing evidence, recording findings, and assigning follow-up actions can become difficult when information is spread across spreadsheets and separate documents.

 

CyberArrow supports third-party risk management through centralized vendor risk assessments, continuous monitoring, compliance tracking, and remediation collaboration with vendors. Its GRC platform helps teams centralize assessment information and track remediation activities.

 

With CyberArrow, organizations can:

 

• Conduct structured third-party assessments and collect supplier responses.
• Start from pre-built risk assessment templates.
• Track vendor compliance status and identified risks.
• Connect supplier risks with broader risk and compliance activities.
• Monitor remediation actions and their progress.

 

Schedule a demo to see how CyberArrow can help organize your third-party risk assessment process.

 

 

FAQs