Procurement, security, and risk · 7 min read
Vendor due diligence checklist
Vendor due diligence is the practice of verifying — before you commit — that a vendor won't introduce risk you can't manage. It spans more than security questionnaires. Use this checklist to cover the dimensions that actually matter.
Security & data
Verify controls against your obligations, not just certificates.
- Where is data hosted and processed; is it encrypted at rest and in transit?
- Can the vendor map controls to your specific obligations (SOC 2, ISO 27001, HIPAA, GDPR)?
- What is the data-return format, cost, and timeline on exit?
Compliance & legal
Confirm the paper matches the pitch.
- Are sub-processors disclosed, and is there advance notice of changes?
- What do the liability cap, carve-outs, and indemnities actually cover?
Financial & operational stability
A cheaper vendor that fails is the most expensive option.
- Is the vendor financially stable; what's the funding/ownership picture?
- What is the support model, and who delivers — named staff or a pool?
Concentration & exit risk
The most overlooked dimension.
- How hard and expensive would it be to replace this vendor if they failed, hiked prices, or were acquired?
- What's the realistic switching cost at years 3, 5, and 7?
Frequently asked
What is a vendor due diligence checklist?
A structured set of checks a buyer runs before committing to a vendor, spanning security and data handling, compliance and legal terms, financial and operational stability, references, and concentration/exit risk. The most overlooked dimension is how hard and expensive the vendor would be to replace.
What should vendor due diligence cover beyond security?
Financial stability, named-staff delivery, sub-processor disclosure, liability and indemnity terms, data-return on exit, and concentration risk — how dependent you'd be and what it would cost to switch away.
Related guides
Run this on your actual deal
Benchside generates the scope, the interrogation questions, and the lock-in math for your specific vendor — first project free.
Start free