Vendor Risk Assessment for Small Business: The Questions That Matter

Define the supplier by the work it performs

A sound assessment begins by naming the job the supplier will perform, because software, record handling, system administration, and payment routing create different exposures. Treat those roles separately instead of giving every supplier the same general security questionnaire.

Weak version: A generic vendor label disguises what the supplier can reach and what it does. Asking only whether the company is secure does not reveal whether it installs a product, stores employee records, administers systems, or handles card and bank movement for your business.

Better version: Separate the assessment by service. A payroll platform holding employee records is not the same risk as a local provider managing laptops or a company routing payments. Judge each role by the access it receives and the work it performs, rather than relying on a supplier-wide assurance.

These categories are not interchangeable: a reassuring support answer does not establish how a hosted database is protected. If the supplier administers your network, assess your own starting configuration as well. The network security setup checks provide a useful baseline for that part of the assessment.

Make the supplier give comparable answers

Useful questions produce written answers that can be compared across suppliers and revisited later. Ask what information the vendor keeps, where it sits, which staff can see it, how access is reviewed, what happens at exit, and whether a recent test summary is available.

Weak version: Asking whether a provider takes security seriously invites a broad assurance that cannot be compared with another supplier's reply. A verbal answer also leaves no record for the next review and does not identify who at the vendor can explain its controls.

Better version: Send narrow questions in writing and request answers from someone responsible for security. Ask who handles the security questionnaire, which data fields are stored and in what country, which staff have access, how access is reviewed, what happens to information after termination or acquisition, and whether a redacted penetration test summary is available.

Use the same questions for each supplier so that replies can be compared next year. Ask which endpoint tools protect the vendor's staff laptops, and keep any phone clarification in the written record. A consistent answer set makes gaps visible without treating a polished conversation as proof of a control.

Ask for records that can be checked

Request dated documents that show who completed the assessment, when testing and access reviews took place, whether administrative accounts use multi-factor authentication, and how an incident can be reported outside normal business hours.

Weak version: Accepting a sales response or general promise leaves the buyer unable to check who stands behind the answer. It also hides whether the vendor can supply a test summary, confirm protections for administrative accounts, or name someone reachable when an incident occurs.

Better version: Ask for a signed and dated questionnaire, the latest penetration test summary and its date, written confirmation that multi-factor authentication covers administrative accounts, the date of the last access review, an after-hours incident contact, and written data return and deletion terms.

A questionnaire returned by sales is not enough; ask for the version signed by the person responsible for the security budget. Record how long copies remain after deletion, since backup and recovery timing affects that promise. CISA's Cybersecurity Performance Goals offer a shared reference for considering protections on administrative accounts.

Treat missing safeguards as a purchase risk

A refusal to discuss security, a ban on breach disclosure, universal administrator access, or an undefined promise to report incidents are reasons to stop. Each removes information or control needed to judge the risk the business would accept.

Weak version: Proceeding despite these replies leaves the buyer unable to assess safeguards or respond to a problem. Silence about security, contractual secrecy around breaches, unrestricted administrator access, and vague notification language each leave an important gap unresolved.

Better version: Record the specific issue and do not proceed on the strength of general assurances. A vendor deep in your supply chain deserves careful attention before signing. Decide whether the service can be replaced if the supplier will not address the gap, rather than treating refusal as a neutral answer.

Put enforceable duties into the agreement

A questionnaire records claims, while the agreement should make important commitments binding. Set out a breach notification period in hours or days, data ownership and return, deletion of remaining copies, subcontractor disclosure, repeat assessments, and the vendor's cooperation during an incident.

Weak version: Relying on a promise to act promptly leaves timing open to interpretation. Omitting data exit, subcontractors, annual reassessment, incident cooperation, or responsibility for customer notices makes it harder to enforce the controls the business needs.

Better version: Write down a defined notification window, data ownership, return and deletion duties, subcontractor disclosure, an annual assessment right, and incident cooperation. The FTC Safeguards Rule requires covered businesses to oversee service providers by contract.

State breach notification deadlines differ, so specify who pays for notice and credit monitoring. Payment instructions need a separate warning: an email asking you to use new bank details is a fraud risk regardless of the supplier's other controls. The business email compromise comparison explains relevant trade-offs, and payment data belongs in the scope.

Keep each review consistent over time

A repeatable assessment uses a short template, applies the same decision criteria, and records refusals rather than overlooking them. For one supplier, allow an afternoon to draft questions and one to two weeks to collect replies; large platforms may take longer than smaller firms.

Weak version: Starting from scratch for every vendor makes answers difficult to compare, while an unnecessarily long template can add questions that do not help the decision. Treating a refusal as neutral also conceals whether the service remains acceptable.

Better version: Build a short template from the questions and records above, use it consistently, and keep replies for the next review. If a supplier declines to answer, record the gap and decide whether you can switch services. Apply the same security controls and decision criteria each time.

Keep the record current when the service changes, and reassess the supplier's role rather than assuming an earlier answer covers new access or payment data. Check whether the vendor can name an incident contact, confirm administrative accounts are reviewed, and explain how information is returned or deleted. For an incident, the first-hours response is easier to plan when those answers are already recorded.