Assurance self-check · about 4 to 6 minutes

Supplier security review

Turn a supplier questionnaire into a scoped decision. Rate 12 original prompts as Operating, Partial, Planned, Not in place or Not sure, see your readiness by area, and get a remediation template for every gap. Everything stays in your browser.

12 prompts4 areas100% privateFree

Start this assessment See all 15

Scope. 12 original supplier review prompts. No vendor certification, contract approval or complete supply-chain assessment is implied. Reference: NIST supply-chain risk guidance (context only, not an endorsement).

What this assessment covers

The 12 prompts, grouped by area. Each one has a "what to look for" note and a concrete action inside the assessment.

Scope

Is the service boundary and business owner identified?
Are shared data types and processing locations understood?
Is the service impact assessed if it becomes unavailable?

Access

Is supplier access limited to the necessary systems and actions?
Are authentication and access reviews part of the arrangement?
Can access be revoked at contract end or during an incident?

Evidence

Does supplied assurance evidence cover the relevant service and period?
Are unresolved answers tracked with owners and decisions?
Are incident and change notification responsibilities understood?

Continuity

Has a recovery capability relevant to this service been reviewed?
Can your data be returned or deleted when the relationship ends?
Is a reassessment triggered by material changes?

How scoring works. Only rated prompts count toward the index. Not sure and unanswered prompts are reported separately and never scored as a pass or a gap. Gaps are listed highest priority first, each with a link to a matching template in the open GRC Documentation Kit. This is a conversation starter, not an audit or a certification.

Start the Supplier security review assessment

Other assessments: NIST CSF 2.0 · ISO 27001 readiness · SOC 2 preparation · Cloud & identity · AI & agent security · SOC & incident readiness · Small business security · Web & API release readiness · Backup & recovery readiness · Secure software delivery · Identity & privileged access · Mobile release readiness · Data protection operations · Security culture & role readiness