How do I check a software vendor’s security before signing a contract?
Short answer
Ask for evidence rather than promises: a recent SOC 2 report or ISO 27001 certificate, how they handle and where they store your data, whether they support SSO and MFA, how they notify customers of breaches, and what happens to your data when the contract ends.
The details
Match the depth of the review to the risk: a tool that holds customer data or connects to your systems deserves more scrutiny than a design app. Record the answers, and put breach notification and data deletion terms in the contract.
Terms explained
- ISO/IEC 27001
- ISO/IEC 27001 is the international standard for an information security management system (ISMS), against which organizations can be independently certified.
- SOC 2
- SOC 2 is an attestation report from an independent CPA firm on a service organization’s controls relevant to security, availability, processing integrity, confidentiality and privacy.
- Multi-factor authentication
- Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.
Sources
Related questions
- What is SOC 2 and who needs it?
- Where should a small business start with cybersecurity?
- How much should a small business spend on cybersecurity?
- Are small businesses really targeted by hackers?
- How do I train employees on cybersecurity without boring them?
- What security policies does a small business need?
Related Guides
GuideSmall Business Security
10 Small Business Cybersecurity Tips to Reduce Risk Fast
Protect your company with ten practical small business cybersecurity tips. Implement MFA, patch software, secure Wi-Fi, and build backups that work.
Read more GuideGRC
How to Run a Vendor Security Assessment Before You Sign
Learn how to conduct a vendor security assessment before signing a contract. Follow these actionable steps to protect your data and reduce supply chain risk.
Read more GuideSmall Business Security
Small Business Cybersecurity Checklist: The Core Controls
A practical small business cybersecurity checklist covering access controls, patching, backups, encryption, and network defense to secure your business.
Read more GuideSmall Business Security
How to Implement Ransomware Prevention in a Small Business
Learn practical ransomware prevention for small businesses. Protect devices, configure offline backups, secure access, and build an effective defense plan.
Read more