What Do Employee Engagement Surveys Tell You About Employee?

Ensuring that your business associations are legally binding is a responsibility to protect your business. The following checklist will help in the vetting of third-party vendors, and on-going monitoring to manage changes and risks.

• Validate Vendor Status

• Confirm vendor’s name, location, business registration and applicable licenses.

• Check for litigations, regulatory fines, or sanctions.

• Review vendor’s credit history, bankruptcy filings.

• Ask for references and review industry reputation and standing (e.g., state registries, Better Business Bureau).

• Secure Legal Contracts

• Verify a Statement of Work (SOW) clearly defines scope, roles, responsibilities, costs, deliverables, and timelines for project(s) and the parties involved.

• Include Service Level Agreement (SLA) for uptime, performance metrics, incident response times, security incident notification requirements, and penalties for failures.

• Document termination clauses for exit strategy if service or product is unsatisfactory or vendor is compromised and include off-boarding process (i.e., data ownership and secure data return or destruction certification) requirements upon contract end or vendor termination.

• Require legal counsel review of all contractual documentation prior to signing any contracts.

• Verify Privacy, Security and Compliance

• Request recent copies of SOC 2, SOC 1, or ISO 27001 audit reports (if applicable).

• Verify compliance with relevant regulations (i.e., HIPAA, PCI-DSS, GDPR, CCPA, etc.).

• Ask for policies and procedures related to data management (i.e., encryption, retention, location (storage & transfer), deletion, destruction) access controls, multi-factor authentication, patching, incident response plans, business continuity plans, and disaster recovery plans.

• Confirm security awareness training is conducted for all employees.

• Ask for current security testing results (e.g., penetration testing, vulnerability scans).

• Monitor and Review 

• Reassess vendor risks at least annually or during contract renewal (i.e., review audit reports and certifications for compliance).

• Monitor for security incidents, lawsuits, regulatory filings, and industry reports for red flags.

• Require vendors to update you with any major changes (ownership, subcontractors, mergers).

• Track SLA performance reports and escalate recurring issues.

• Use a vendor risk scoring system (e.g., low, medium, high risk).

• Ask for security incident updates and reports, including proof of remediation (if applicable).

Your vendors can either strengthen or weaken your security reputation. Using this checklist ensures that contracts are enforceable, risks are transparent, and vendor obligations are measurable. Always pair vendor assessments with legal review and ongoing monitoring.

Let Resilient Excellence Consulting help you identify potential issues before they escalate by conducting a well-structured risk assessment for your organization. Contact us to get your Risk Clarity Protocol™ to better protect what matters most to you. 

There are many variations of passages of Lorem Ipsum available, but the majority have suffered alteration in some form, by injected humour, or randomised words which don't look even slightly believable. If you are going to use a passage of Lorem Ipsum, you need to be sure there isn't anything embarrassing hidden in the middle of text. All the Lorem Ipsum generators on the Internet tend to repeat predefined chunks as necessary, making this the first true generator on the Internet. It uses a dictionary of over 200 Latin words, combined with a handful of model sentence structures, to generate Lorem Ipsum which looks reasonable. The generated Lorem Ipsum is therefore always free from repetition, injected humour, or non-characteristic words etc.

There are many variations of passages of Lorem Ipsum available, but the majority have suffered alteration in some form, by injected humour, or randomised words which don't look even slightly believable. If you are going to use a passage of Lorem Ipsum, you need to be sure there isn't anything embarrassing hidden in the middle of text. All the Lorem Ipsum generators on the Internet tend to repeat predefined chunks as necessary, making this the first true generator on the Internet. It uses a dictionary of over 200 Latin words, combined with a handful of model sentence structures, to generate Lorem Ipsum which looks reasonable. The generated Lorem Ipsum is therefore always free from repetition, injected humour, or non-characteristic words etc.