Template
Vendor Inventory
A single record of who holds your data, what they hold, and when you last looked at them.
Beginner
25 min
Free
NIST CSF
SOC 2
Published · v1.0.0 · 2026-08-01
Checklist
Vendor Security Review Checklist
A proportionate review for the vendors that actually hold your data — without sending a two-hundred-question survey.
- Intended audience
- Anyone approving software or service purchases
- Difficulty
- Beginner
- Estimated time
- 20 minutes
- Access
- Free
NIST CSF
SOC 2
All industries
Version v1.0.0 · Last reviewed 2026-08-01 · Document owner: ComplianceAnvil Content Team
What you will be able to do
- Match the depth of a vendor security review to the sensitivity of the data the vendor touches.
- Collect the minimum evidence needed to judge a vendor's security posture, such as a current audit report.
- Confirm contractual commitments for breach notification and data deletion before signing.
- Maintain a vendor inventory with risk ratings and review dates.
Right-size the review
Match effort to exposure. A vendor holding customer records deserves more scrutiny than a scheduling tool that stores nothing sensitive.
Key takeaways
- Review effort should be proportionate to exposure — a vendor holding customer records deserves more scrutiny than one that stores nothing sensitive.
- A current security summary, audit report, or trust page is a practical substitute for a lengthy custom questionnaire.
- Breach notification and data deletion terms should be confirmed in the contract, not assumed.
- Every reviewed vendor should be added to an inventory with an assigned risk rating and a renewal date.
Checklist
Progress0 of 10 (0%)
Progress is saved in this browser only. It is not a compliance record.
Sources
Written from these public, authoritative publications. ComplianceAnvil paraphrases and summarizes them; it does not reproduce copyrighted control text.
NIST · 2.0
Cybersecurity Framework (CSF) 2.0(opens in a new tab)Link last confirmed 2026-02-01
Federal Trade Commission
FTC Safeguards Rule: What Your Business Needs to Know(opens in a new tab)Link last confirmed 2026-02-01
Earn a Certificate of Training Completion
Complete every section, acknowledge, and pass the knowledge check.
Sections opened0 of 1
This certificate recognizes completion of educational training material only. It is not a professional certification, accreditation, license, compliance assessment, audit result, or attestation of compliance with any law, regulation, or contract requirement. ComplianceAnvil is not a certification authority, accreditation body, assessor, or law firm.
How this was written and reviewed
Published
- Author
- ComplianceAnvil Editorial Team
- Technical reviewer
- ComplianceAnvil Technical Review Board
- Jurisdiction
- United States (federal)
- First published
- 2026-08-01
- Last reviewed
- 2026-08-01
- Next review due
- 2027-08-01
Version v1.0.0 · Document owner: ComplianceAnvil Content Team
Important
This resource is educational readiness material. ComplianceAnvil is not a certification authority, assessor, or law firm, and this content is not legal advice or a compliance assessment.
Related resources
Matched on shared frameworks, topics, and program packs.
Guide
Preparing for Vendor Questionnaires
How to answer customer security questionnaires quickly, accurately, and without overpromising.
Intermediate
12 min
Free
SOC 2
NIST CSF
Published · v1.0.0 · 2026-08-01
Template
Acceptable Use Policy
What employees may and may not do with company systems, data, devices, and AI tools.
Beginner
25 min
Free
NIST CSF
Published · v1.0.0 · 2026-08-01
Guide
Building a Security Program from Scratch
A ninety-day sequence for a business with nothing written down yet — cheapest, highest-impact work first.
Beginner
14 min
Free
NIST CSF
CIS Controls
Published · v1.0.0 · 2026-08-01
Exercise
Complete a Readiness Scorecard
Score yourself honestly across six areas and turn the two lowest into a short plan.
Beginner
15 min
Free
NIST CSF
Published · v1.0.0 · 2026-08-01
Template
Information Security Policy
The parent policy that states what your organization protects, who is responsible, and how the rest of your documentation hangs together.
Intermediate
45 min
Free
NIST CSF
NIST SP 800-171
Published · v1.0.0 · 2026-08-01
Put this into practice
Resources tell you what good looks like. A Program Pack does the work with you — generated documentation, tracked controls, training, and evidence in one workspace.