Third-Party Vendor Security Risk Assessor

Require vendor's bridge letter if audit report is older than 12 months.

Review Statement of Applicability (SoA) for covered boundaries.

Verify penetration test was performed by accredited CREST/OSCP firm.

Ensure vendor enforces annual mandatory employee security awareness training.

Reject the 'SSO Tax'—vendor must support centralized corporate IdP integration.

Confirm SMS/phone-based verification is strictly disallowed for privileged access.

Enforces immediate revocation of terminated corporate employee accounts.

Verify vendor staff access to customer production data requires time-limited JIT elevation.

Verify key rotation cycles and support for Customer-Managed Keys (BYOK/HYOK).

Ensure legacy TLS 1.0/1.1 protocols and weak cipher suites are completely disabled.

Verify contractual liability caps and explicit data ownership clauses.

Prevent cross-tenant query contamination through row-level security or dedicated schemas.

Mandate prompt disclosure to comply with SEC (4 days) and GDPR (72 hours) statutes.

Review post-drill executive summary showing failover verification.

Ensure backups cannot be modified or deleted without multi-party authorization.

Retain unilateral right to terminate agreement if proposed subprocessor is unacceptable.

Enforces Snyk / Wiz scanning to detect upstream zero-days and malicious packages.

Ensures external ethical researchers can safely disclose zero-days.