Vendor Security Risk Assessment: A Practical Guide
Third-party vendors are your largest uncontrolled attack surface. StartComply automates vendor security risk assessment from questionnaire distribution to audit-ready evidence packs, so your team can prove compliance under NIS2, DORA, and ISO 27001.
Trusted by 100+ organisations across Europe
NIS2 
DORA 
ISO 27001:2022 
Vendor Risk What you need to know about vendor security risk assessment
- A vendor security risk assessment evaluates the cybersecurity posture of third-party suppliers that access your systems, data, or infrastructure.
- NIS2 Article 21(2)(d) and DORA Article 28 make vendor assessments a legal compliance obligation for essential entities and financial organisations across the EU.
- A repeatable programme requires vendor inventory, tiered questionnaires, evidence review, risk scoring, findings management, and continuous monitoring.
- The vendor risk register must be audit-ready, with every risk score evidenced, every finding tracked, and every record kept current.
- Spreadsheets cannot enforce evidence linkage, automate reassessment cycles, or generate regulator-ready exports on demand.
- DORA financial entities must complete pre-contractual assessments, maintain an ICT third-party register, and continuously monitor ICT providers throughout the contract lifecycle.
- Shadow IT creates shadow vendor risk. Complete inventory requires procurement, IT, finance, legal, compliance, and business unit input.
Sources: NIS2 Directive, DORA Regulation. Last updated January 2025.
Vendor Security Assessment Is a Compliance Requirement
A documented, evidenced, continuous vendor risk programme
- NIS2 Article 21(2)(d): supply chain security covering direct suppliers and service providers
- DORA Article 28: ICT third-party register, pre-contractual due diligence, and ongoing monitoring
- DORA Article 30: audit rights, exit provisions, incident terms, and sub-outsourcing controls
- ISO 27001:2022 Annex A 5.19 to 5.22: supplier information security and monitoring
- Documented evidence available on demand for auditors, regulators, and certification bodies
Penalty exposure: NIS2 essential entities may face fines up to €10M or 2% of global annual turnover. Sources: NIS2 Directive, DORA Regulation.
Spreadsheets, unanswered questionnaires, and undocumented decisions
- Incomplete vendor inventory, with SaaS tools and department-level suppliers missing from scope
- Questionnaire-only assessments with no certificate, SOC 2, or penetration test evidence review
- Risk scores based on judgement calls rather than documented scoring rationale
- Static registers that are not updated when certifications lapse or incidents occur
- No findings workflow, no owner, no deadline, and no escalation path
- No audit-ready export when regulators ask for the vendor risk posture
The audit reality: regulators do not ask whether vendor assessments exist. They ask for files, dates, owners, scores, evidence, decisions, and follow-ups.
Everything You Need for Vendor Security Risk Assessment
Vendor Inventory and Risk Tiering
Create one authoritative record for every vendor that touches your systems, data, or infrastructure. Classify vendors by access, data sensitivity, service criticality, and regulatory scope.
- Complete vendor inventory across procurement, IT, legal, and finance
- Risk tiering for critical, high, medium, and low-risk suppliers
- Access mapping for systems, data, infrastructure, and ICT services
- DORA ICT third-party register fields available from the start
Automated Security Questionnaires
Stop chasing vendor responses by email. StartComply distributes tier-based security questionnaires, tracks deadlines, escalates late responses, and stores every answer against the vendor record.
- Automated questionnaire workflows with reminders and escalation
- Control mapping for NIS2, DORA, and ISO 27001
- Tier-based questionnaire depth for critical and low-risk vendors
- Centralised response history for repeat assessments
Evidence Review, Risk Scoring, and Monitoring
Questionnaire answers are not enough. StartComply links every risk score to evidence, tracks findings to closure, and monitors vendor posture between assessment cycles.
- Evidence-linked risk scoring for ISO 27001, SOC 2, pen tests, and contracts
- Findings management with owners, deadlines, and remediation status
- Continuous monitoring for incidents, certification lapses, and threat signals
- Audit-ready exports for regulators, auditors, and management review
StartComply vs. The Alternatives
Not every vendor security risk assessment process creates the evidence that NIS2, DORA, and ISO 27001 auditors expect.
StartComply was built for European compliance teams that need evidence-first vendor risk assessment without months of enterprise GRC configuration.
What Is a Vendor Security Risk Assessment?
A vendor security risk assessment is a formal evaluation of the security posture of a third-party organisation that has access to your systems, data, infrastructure, or regulated business processes. It reviews the controls the vendor has in place, the access they hold, and the potential impact if that vendor is compromised.
The scope is broader than most teams realise. It includes cloud service providers, software vendors, managed service providers, outsourced processing partners, contractors with privileged access, and any supplier in your chain that touches regulated data or critical systems.
A typical assessment combines three inputs: a structured security questionnaire, independent evidence such as ISO 27001 certificates or SOC 2 reports, and an internal review of data, system, and infrastructure access. The output is a risk score, supporting rationale, and remediation actions. This is distinct from a broader threat vulnerability risk assessment, which focuses on threats to your own systems rather than risk introduced by third-party relationships.
Vendor risk is not only an IT issue. Procurement, legal, finance, compliance, and security all hold pieces of the evidence auditors will expect to see.
How to Conduct a Vendor Security Risk Assessment in Four Steps
Build and tier your vendor inventory Scope
Before assessing anything, build a complete inventory of all active vendor relationships. Pull from procurement, IT, legal, and finance so every vendor that touches systems, data, or infrastructure appears in the register. Critical vendors need deeper assessment because they hold regulated data, production access, or operational dependency.
Distribute security questionnaires Controls
Send each vendor a questionnaire mapped to its risk tier. Critical vendors usually require a deeper control review aligned to ISO 27001 Annex A or CAIQ-style criteria, while low-risk vendors may need a shorter screening questionnaire. StartComply automates distribution, reminders, and escalation when response windows are missed.
Review evidence and score risk Audit trail
Questionnaire answers alone are not enough. Review ISO 27001 certificates, SOC 2 reports, penetration test summaries, data processing agreements, and contractual terms. Risk scoring must be reproducible, with every score linked to supporting evidence and a clear rationale.
Remediate, monitor, and reassess Continuous
Vendor assessments are point-in-time. Certifications lapse, service scope changes, staff leave, and incidents happen between cycles. Set reassessment cadence by tier, trigger out-of-cycle reviews for incidents, and use the cyber security risk assessment checklist to define practical reassessment triggers.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About Vendor Security Risk Assessment
What is a vendor security risk assessment and why is it required?
A vendor security risk assessment is a structured evaluation of a third-party supplier’s cybersecurity controls, data handling practices, and potential impact on your organisation if that supplier is compromised. It is required because NIS2 Article 21 and DORA Article 28 make third-party risk management a mandatory legal obligation for essential entities and financial organisations in the EU. Beyond regulation, vendors are a primary attack vector and must be assessed with evidence, not assumptions.
How often should vendor security risk assessments be repeated?
Assessment frequency should be risk-based. Critical vendors with production access or regulated data should be assessed at least annually, with continuous monitoring in between. Medium-risk vendors typically require annual or biennial assessments. Low-risk vendors may need only periodic screening. Out-of-cycle reassessments should be triggered by vendor-reported incidents, certification lapses, service scope changes, or threat intelligence alerts.
What evidence should I collect during a vendor security risk assessment?
Questionnaire responses alone are insufficient. Collect independent evidence such as current ISO 27001 or SOC 2 Type II certificates, recent penetration test executive summaries, data processing agreements, business continuity test results, and sub-processor lists. For DORA-critical vendors, also review contractual audit rights and exit provisions under Article 30. Evidence must be date-stamped, stored against the vendor record, and reviewed at each reassessment cycle.
What is the difference between a vendor security risk assessment and a supplier audit?
A vendor security risk assessment is a periodic, scalable evaluation applied across your vendor population, usually combining questionnaires and document review. A supplier audit is a deeper examination of a specific vendor’s controls and processes, sometimes on site. Assessments are the baseline for all relevant vendors, while audits are usually reserved for critical vendors, unresolved findings, sensitive data exposure, or DORA audit-right scenarios.
Does NIS2 require vendor security risk assessments for all suppliers?
NIS2 Article 21(2)(d) requires essential and important entities to address supply chain security, covering direct suppliers and service providers. The obligation applies to relationships relevant to the provision of your network and information systems, not necessarily every procurement relationship. In practice, any supplier with IT access, personal data processing, or operational dependency should be in scope. Regulators expect a proportionate tiered approach, where assessment depth matches vendor risk.
Can I use a vendor’s ISO 27001 certificate instead of conducting my own assessment?
ISO 27001 certification reduces but does not eliminate your assessment obligation. A valid certificate is strong supporting evidence, but you still need to verify the certificate scope, confirm it is current, and assess residual risks specific to your relationship. Certification is supporting evidence, not a substitute for due diligence under NIS2, DORA, or your own vendor risk policy.
Stop Managing Vendor Security Risk with Spreadsheets.
Which Vendor Relationships Need Assessment?
Not every supplier needs the same level of review, but every relevant vendor relationship must be classified. The assessment depth should match the vendor’s access, data exposure, service criticality, and regulatory relevance.
StartComply helps teams separate critical vendor relationships from lower-risk suppliers, so the right level of evidence is collected without slowing down procurement.
Shadow IT creates shadow vendor risk. A complete vendor inventory requires cross-functional input from procurement, IT, finance, legal, compliance, and the business units buying the tools.
Vendor Assessment Lifecycle: From Onboarding to Reassessment
Pre-contractual due diligence runs before a new vendor is approved. DORA Article 28 expects ICT third-party risk to be assessed before engagement.
Contractual controls are checked, including audit rights, security requirements, sub-outsourcing terms, incident notification, and exit provisions.
The vendor is monitored throughout the relationship. Certifications, incidents, access changes, and service scope changes can trigger reassessment.
Out-of-cycle review starts when a vendor reports an incident, loses a certification, changes sub-processors, or gains new access.
The next assessment is completed according to vendor tier. Critical vendors should not sit for years with stale evidence and outdated scores.
DORA financial entities?
DORA became fully applicable in January 2025. Financial entities must maintain an ICT third-party register, document pre-contractual assessments, and monitor ICT providers throughout the contract lifecycle.
What Your Vendor Risk Register Must Include
The vendor risk register is the output regulators will ask to see. It must contain more than supplier names and traffic-light scores. StartComply can also support teams building the programme from scratch through cybersecurity risk assessment services.
Vendor identity and category
Legal name, service category, business owner, contract owner, and whether the supplier provides ICT, data processing, operational, or advisory services.
Access and data classification
The systems accessed, data processed, sensitivity level, privileged access status, and whether regulated or personal data is involved.
Last assessment date
The date the most recent vendor security risk assessment was completed, with the assessment version and responsible reviewer recorded.
Current risk score and rationale
The vendor’s current score, the scoring model used, and the documented rationale linking impact, likelihood, access, and evidence.
Evidence records
Certificates, SOC 2 reports, penetration test summaries, DPAs, BCP test results, sub-processor lists, and contractual security terms.
Open findings and remediation status
Every gap, owner, due date, status, escalation point, and closure evidence. Untracked findings create audit exposure.
Next reassessment date
The planned reassessment cadence based on vendor tier, plus triggers for out-of-cycle review after incidents or material service changes.
DORA contractual references
For financial entities, Article 28 and Article 30 data covering audit rights, exit provisions, sub-outsourcing, and ICT contractual arrangements.
