Regulators, auditors, and enterprise customers consistently flag third-party risk as one of the top unmanaged threats in compliance programmes. SOC 2 (CC9.2), ISO 27001 (A.5.19–5.22), HIPAA (§164.308(b)), and GDPR (Article 28) all require formal supplier due diligence. Here is how to build a programme that satisfies all four.

Step 1: Build Your Vendor Inventory

  • List every third party that accesses, processes, stores, or transmits your sensitive data or connects to your systems.
  • Categorise vendors by data type handled: personal data, health data, financial data, or infrastructure access.
  • Flag any vendors that are sub-processors under GDPR or Business Associates under HIPAA — these require specific agreements.

Step 2: Tier Your Vendors by Risk

  • Critical (Tier 1): Vendors with direct access to production systems or sensitive data (cloud infrastructure, identity providers, payroll processors). Annual security reviews, SOC 2 or ISO 27001 reports required, penetration test results reviewed.
  • High (Tier 2): Vendors that process company or customer data but with limited direct access. Annual questionnaires and contract reviews.
  • Standard (Tier 3): Low-risk vendors (marketing tools, office supplies). Lightweight periodic review.

Step 3: Due Diligence Activities

  • Request and review current SOC 2 Type II or ISO 27001 certificates for Tier 1 vendors.
  • Send a standardised security questionnaire (CAIQ, SIG, or a custom questionnaire) to vendors without third-party certifications.
  • Verify cyber insurance coverage for critical vendors.
  • Review the vendor's incident response and breach notification procedures.
  • Confirm sub-processor lists are up-to-date and include flow-down obligations.

Step 4: Contract Requirements

  • Require Data Processing Agreements (GDPR), Business Associate Agreements (HIPAA), or equivalent data protection clauses in every vendor contract involving personal data.
  • Include audit rights, breach notification timelines (72 hours is the GDPR standard), and data return/deletion obligations at contract end.
  • Specify minimum security standards (encryption at rest and in transit, MFA, penetration testing frequency).

Step 5: Ongoing Monitoring

  • Track vendor SOC 2 / ISO 27001 certificate expiry dates and request renewals before they lapse.
  • Subscribe to vendor security mailing lists and monitor breach news.
  • Re-assess vendors after significant changes: M&A activity, major security incidents, or changes to data processing scope.
  • Log all vendor risk decisions as audit evidence.