The Ultimate Vendor Risk Management Checklist

This document provides vendor due-diligence guidance and a 15-item risk assessment checklist to help organizations evaluate and manage third-party cybersecurity posture—covering cloud configuration, application security, encryption, incident response, access controls, logging, MFA/password policies, security awareness, BYOD and VPN controls, physical security, email/antispam, endpoint protection, device decommissioning, and patching cadence—and recommends continuous monitoring (e.g., SecurityScorecard) to validate vendor security over time.