The 300-question spreadsheet makes everyone feel diligent and tells you almost nothing. Five questions, tiered by what the vendor actually holds, does better.
Third-party risk assessment arrived in the mid-market as a hand-me-down from enterprise, and it arrived in its enterprise form: a long questionnaire, self-scored by the vendor, filed somewhere, and never looked at again.
It persists because it produces an artefact. There is a completed document in a folder, which means diligence was performed, which means somebody can point at it later. The fact that nobody read the answers and that the vendor's own marketing team filled in half of them does not change the artefact's existence.
If you are going to spend the effort, here is a version that produces information.
Tier first, or you will do it to nobody
The reason most programmes collapse is that they treat all vendors alike. Three hundred questions for the payroll provider and three hundred for the company that supplies the coffee machine software. The first month is thorough, the second is slower, and by month four the process has quietly stopped.
For a business of 50 to 500 people, the distribution is predictable: three to six vendors in the top-right, a handful in each of the other quadrants, and a long tail of low-touch software that needs an owner and a renewal date and nothing more.
Getting that distribution right is most of the work. Everything after it is cheap.
Five questions
For the vendors that warrant real scrutiny, these five produce more signal than the long form.
"Where is our data, and which of your people can reach it?"
You are listening for specificity. A vendor who answers in named regions and named roles has thought about it. A vendor who says "securely, in the cloud" has not, and the follow-up question about subprocessors will usually confirm it.
"What is your incident notification commitment, in hours?"
Most contracts say the vendor will notify affected customers without undue delay, which is not a commitment. Ask for a number. Twenty-four or forty-eight hours is reasonable for most services. Refusal to give any number is itself an answer.
"What do we get on exit?"
Format, completeness, timeframe, cost. Negotiate this at purchase, when you have leverage, and get it in the contract rather than in an email. The cost of exit is the single most under-examined term in SaaS agreements, and it is the one that determines whether your options in three years are real.
"Do you have a current independent audit report?"
SOC 2 Type 2, ISO 27001, or the equivalent in their market. You do not have to read ninety pages. Three checks take ten minutes:
- Date. Is it current, and does the observation period cover the last year rather than a quarter in 2024?
- Scope. Does it cover the product you are buying? A report scoped to the parent company's corporate IT does not tell you about the service.
- Exceptions. The one section worth reading in full. A clean report with no exceptions at all is less informative than one with three honestly described and remediated.
"Do you subcontract any of this, and to whom?"
Your vendor's vendors are your exposure. The answer is frequently longer than expected and frequently the most useful thing you learn.
What to stop doing
Self-scored maturity ratings. Asking a vendor to rate their own security out of five produces a four. Every time.
Questionnaires you will not read. If nobody will read the answers, sending the questions is worse than not sending them, because it creates a record implying you assessed something you did not.
Certification logos without scope. A badge on a website is a marketing asset. The scope statement in the actual certificate is the information.
Treating the questionnaire as the control. The questionnaire tells you what the vendor says. The contract is what you can enforce. If something matters, it belongs in the agreement.
Put the important parts in the contract
Four clauses worth insisting on for a top-tier vendor, in rough order of how often they are missing:
Notification within a stated number of hours of an incident affecting your data.
Audit or evidence rights, which in practice usually means the right to receive their current audit report annually rather than a right to turn up and inspect.
Subprocessor notification, so that a change in who handles your data is something you are told about rather than something you discover.
Defined exit assistance, with the format and the timeframe stated and the cost either zero or capped.
None of these are unusual and most vendors will agree to them if asked before signature. Very few will reopen the agreement afterwards.
The annual re-check, kept small
Once a year, for the top tier only: has the audit report been refreshed, has anything material changed in what they hold, have they had an incident, and is the owner on our side still the right person?
Fifteen minutes per vendor, six vendors, once a year. That is a programme somebody will actually run, which makes it worth more than the comprehensive one that gets abandoned in March.
The honest summary
Vendor risk management at this scale is not about discovering that a vendor is insecure. You are unlikely to find that out from a questionnaire, and if a major provider has a bad year you were not going to prevent it.
It is about knowing which vendors you could not survive losing, having an answer for each of those, and making sure the contract contains the handful of terms you will need if something goes wrong. That is achievable in a fortnight, and it is more than most organisations of this size have.
