SIG-Aligned Vendor Assessment Checklist

An editable 15-page checklist for analyst-led vendor reviews. Every question carries its evidence expectation, a response field and space for notes.

What’s inside

• Domains covered: governance, ownership, data, access, vulnerability management, logging, incident response, notification, resilience, recovery, subcontractors, assurance, contracts, exit, asset management, personnel, physical, privacy, continuity, audit, security testing and exceptions
• The evidence each question expects, such as a RACI matrix for ownership, RTO and RPO with recent test results for recovery, and a time-bound exception register
• Yes, Partly, No and Not Applicable responses, so a half-answered control can be recorded as one rather than forced to pass or fail
• A six-step workflow, and what to prioritise at onboarding, renewal, a material change and approval
• How to validate evidence, covering scope, date, control owner, test coverage and exceptions, with a worked example on a cloud support vendor

The last pages show the same review running on SAFE’s TPRM platform. See how SAFE handles TPRM.