Security Review: What Buyers Assess Before They Let a Vendor Near Their Data

A security review asks a single practical question: if we let this supplier hold our data or reach into our systems, what could go wrong, how likely is it, and could we live with it. It is a risk assessment, not an examination with a pass mark, and understanding that changes how it should be answered. Reviewers expect to find gaps in every supplier they assess. What they are looking for is whether the supplier knows where its gaps are.

The review usually sits alongside legal review and data protection review inside a procurement process rather than after them. Treating the three as sequential is one of the most common and most avoidable causes of a slipped close date, because each of them is queue-driven and they can generally run at the same time.

Access and identity

How accounts are created, what an administrator can do, how rights are removed when someone leaves, whether multi-factor authentication is available, and whether the buyer's own single sign-on can be used. This section receives the closest attention because most real incidents involve access rather than exotic technical failures.

Data handling

What data the product holds, where it is stored and processed, whether it is encrypted in transit and at rest, how long it is retained, and what happens to it when the contract ends. Answers should describe what is actually implemented in the product rather than what is generally true of the underlying infrastructure, because reviewers ask that follow-up question routinely.

The supply chain

Which third parties also touch the data, what each one does, where they are located, and how the buyer will be told when the list changes. Risk is transitive, and a buyer's obligations to their own customers do not end at your organisational boundary.

Operations and incidents

Backups and recovery, monitoring, how an incident is detected and escalated, who is notified within what period, and what the customer is told. Reviewers assess process rather than promises here, and a described procedure with named responsibilities is worth more than an assurance about diligence.

Answer completely on the first pass. Reviews run on queues, and a response that generates clarifying questions goes back to the end of one that may only be worked through weekly. The time cost of a partial answer is therefore much larger than it appears, and frequently larger than the cost of an answer the buyer does not like.

Answer honestly, including where the answer is no. A missing control accompanied by a description of the compensating measure is an ordinary finding that reviewers document and move past. An answer that later proves inaccurate is a different category of problem entirely, because it forces the reviewer to treat every other answer as unverified, and there is no efficient way back from that.

Answer consistently. Two reviewers in the same organisation frequently compare notes, and inconsistent answers across deals or across time are one of the fastest ways to trigger deeper scrutiny. A single maintained answer set with a named owner and a revision date solves this at very low cost and improves the quality of every response.

Most stalled reviews are stalled on process rather than on findings. A document was requested from someone who no longer works on the deal. An answer needed clarification and the follow-up went to an unmonitored address. A questionnaire was sent in a format nobody could open. None of these are security problems, and all of them cost weeks.

The defence is to treat the review as a tracked stage of the deal with an owner and dates on both sides, in the same way a technical evaluation is tracked. A deal sitting in security review looks identical in most pipelines to a deal sitting in a decision, and telling the two apart is what allows the right person to be chased about the right thing.

A data processing agreement is the contractual instrument covering how personal data is handled, and it is usually reviewed alongside security. Vendor onboarding is the administrative registration of a supplier for payment, which is a separate process from risk assessment. Third-party risk management is the buyer-side programme that security reviews belong to. A penetration test is one form of evidence within a review rather than a substitute for it.

Related pages on buying, evaluating and switching:book a demo, features overview, what a CRM is, pricing, compare alternatives, and switching from HubSpot.