Vendor and third-party risk: what to ask your software providers

Your company's data doesn't only live on your own laptops. It lives in your email provider, CRM, accounting software, payroll system, website host, form builder, and the dozens of other services you've signed up for over the years. Each of those vendors is part of your security, whether you've checked them or not.

Vendor risk management sounds like a big-company process. At small scale it's simply this: know who holds your data, ask a few good questions before you hand it over, and be able to get it back when you leave.

Start with a vendor list

You can't assess what you don't know about. Build a simple spreadsheet with:

Vendor name and what it's used for
What data it holds (customer records, payments, employee files, nothing sensitive)
Who owns the account internally, and which email address it's registered to
Whether it uses SSO or two-factor
Contract renewal date
Date you last reviewed it

Good places to find vendors you've forgotten: your credit card and bank statements, the "connected apps" list in Google Workspace or Microsoft 365, and your password manager.

Tier your vendors

Not every tool needs the same scrutiny. A simple three-tier approach:

Tier	What it covers	How much checking
High	Holds sensitive customer, financial, health, or employee data, or has admin access to your systems (email, payroll, CRM, IT provider, web host)	Full question list below, review yearly
Medium	Holds business data that would be embarrassing or disruptive to lose	Key questions: two-factor, export, breach notice
Low	No sensitive data, easy to replace	Basic check at sign-up

Contractors and agencies with access to your accounts belong in this list too. That includes us, if you work with Chykalophia. See how we protect your credentials for the kind of answer you should expect from any agency.

The questions to ask

You often don't need to email anyone. Many vendors publish a security or trust page that answers most of these. Look for links labeled "Security," "Trust center," or "Compliance" in the site footer.

Do you support two-factor authentication? Can we require it for all our users?
Do you support single sign-on (SSO) with Google or Microsoft? On which plan? See single sign-on.
Can we set different permission levels and see an audit log of who did what?

Protecting the data

Is our data encrypted in transit and at rest?
Which of your staff can access our data, and under what circumstances?
Where is our data stored (which countries)?
Which subprocessors (other companies) do you share it with? Is there a published list?

Independent assurance

Do you have a SOC 2 Type II report or ISO/IEC 27001 certification? Can we see the report or certificate, or a summary? See security questionnaires and SOC 2 for what these mean.
When was your last independent penetration test?

When things go wrong

How quickly will you notify us of a breach affecting our data, and how?
How do you back up our data, and how quickly can you restore it?
Do you publish a status page and incident history?

AI and data use

Do you use our data to train AI models? Can we opt out, and is opting out the default on our plan?
Do any AI features send our data to another provider?

Leaving

Can we export all our data in a usable format, at any time?
What happens to our data when we cancel? How long until it's deleted?
Will you sign a data processing agreement (DPA)? This matters if you're subject to GDPR or similar laws.

How to judge the answers

Clear, specific, published answers are a good sign. Warning signs include:

No security page and no answer when asked
Two-factor authentication not available at all
"We take security seriously" with no specifics
No way to export your data
Vague answers about who can see your data
A claim to be "SOC 2 certified" (SOC 2 is an attestation report, not a certification, so the wording suggests the vendor may not know the details)

No vendor will be perfect. You're looking for honest, specific answers proportionate to the data you're trusting them with.

Keep control of your accounts

The most common vendor problem in small companies isn't a breach at the vendor. It's an account that belongs to the wrong person.

0 of 4 done

Register important accounts to a role-based company address (like admin@ or billing@), not one person's inbox
Make sure at least two people in your company have admin access to high-tier vendors
Store the credentials in your company password manager
Remove contractor access when a project ends. See how to revoke an agency's access.

Saved in this browser only.

Frequently asked questions

We're tiny. Will a vendor really answer our questions?

Large vendors usually won't answer individual questionnaires from small customers, but they publish most of the answers on their trust pages. Smaller vendors are often happy to answer directly. Either way, the answer (or lack of one) tells you something.

How often should we review vendors?

High-tier vendors once a year, ideally near renewal. Also review whenever a vendor announces a breach, changes ownership, or changes its terms around data use.

Do clients expect us to do this?

Increasingly, yes. Larger clients often ask how you manage your own vendors as part of their security questionnaires. A maintained vendor list makes that question easy.