Checklist
Vendor Security Review Checklist
A proportionate review for the vendors that actually hold your data — without sending a two-hundred-question survey.
Beginner
20 min
Free
NIST CSF
SOC 2
Published · v1.0.0 · 2026-08-01
Template
Vendor Inventory
A single record of who holds your data, what they hold, and when you last looked at them.
- Intended audience
- Owners, finance, and program leads
- Difficulty
- Beginner
- Estimated time
- 25 minutes
- Access
- Free
NIST CSF
SOC 2
All industries
Version v1.0.0 · Last reviewed 2026-08-01 · Document owner: ComplianceAnvil Content Team
What you will be able to do
- Capture the columns needed to track which vendors hold your data and why.
- Record contract status, renewal dates, and risk ratings for each vendor.
- Track whether a data processing agreement is in place for each vendor relationship.
Columns to capture
- Vendor name and service purpose.
- Data accessed and sensitivity.
- Internal account owner.
- Contract status and renewal date.
- Risk rating and review status.
- Data processing agreement in place: yes or no.
Key takeaways
- A vendor inventory should record what data each vendor accesses and its sensitivity, not just the vendor's name.
- Assigning an internal account owner to each vendor relationship ensures someone is accountable for it.
- Tracking contract status and renewal dates prevents vendors from lingering after their agreements lapse.
- A risk rating per vendor helps prioritize which relationships need closer review.
- Recording whether a data processing agreement exists highlights gaps in vendor data-handling commitments.
Sources
Written from these public, authoritative publications. ComplianceAnvil paraphrases and summarizes them; it does not reproduce copyrighted control text.
NIST · 2.0
Cybersecurity Framework (CSF) 2.0(opens in a new tab)Link last confirmed 2026-02-01
Federal Trade Commission
FTC Safeguards Rule: What Your Business Needs to Know(opens in a new tab)Link last confirmed 2026-02-01
How this was written and reviewed
Published
- Author
- ComplianceAnvil Editorial Team
- Technical reviewer
- ComplianceAnvil Technical Review Board
- Jurisdiction
- United States (federal)
- First published
- 2026-08-01
- Last reviewed
- 2026-08-01
- Next review due
- 2027-08-01
Version v1.0.0 · Document owner: ComplianceAnvil Content Team
Important
This template is provided for readiness and educational purposes. Organizations should review and adapt it for their environment.
Related resources
Matched on shared frameworks, topics, and program packs.
Checklist
Evidence Collection Checklist
Turn what you already do into evidence: what to capture, how to label it, and how long to keep it.
Intermediate
25 min
Free
CMMC
NIST SP 800-171
Published · v1.0.0 · 2026-08-01
Guide
Preparing for Vendor Questionnaires
How to answer customer security questionnaires quickly, accurately, and without overpromising.
Intermediate
12 min
Free
SOC 2
NIST CSF
Published · v1.0.0 · 2026-08-01
Guide
Building a Security Program from Scratch
A ninety-day sequence for a business with nothing written down yet — cheapest, highest-impact work first.
Beginner
14 min
Free
NIST CSF
CIS Controls
Published · v1.0.0 · 2026-08-01
Guide
Common Compliance Mistakes
The recurring, expensive errors we see small businesses make — and the cheap correction for each.
Beginner
9 min
Free
NIST CSF
NIST SP 800-171
Published · v1.0.0 · 2026-08-01
Exercise
Complete a Readiness Scorecard
Score yourself honestly across six areas and turn the two lowest into a short plan.
Beginner
15 min
Free
NIST CSF
Published · v1.0.0 · 2026-08-01
Put this into practice
Resources tell you what good looks like. A Program Pack does the work with you — generated documentation, tracked controls, training, and evidence in one workspace.