Remote GRC service
Vendor Risk Assessment Services
Third-party and vendor risk assessment: supplier tiering, security questionnaires, evidence review, contract clauses, GDPR Article 28 checks and ongoing monitoring of critical suppliers.
Suppliers hold your data and run parts of your service, so their weaknesses become your incidents. A vendor risk program decides how deeply to review each supplier, what to require in contracts and how to keep watching critical ones.
Ian sets up and runs proportionate third-party risk reviews. Available as a consulting project, a fixed-term contract or as part of a full-time remote role, depending on what your organisation needs.
Who it is for
- Organisations onboarding SaaS and service providers that handle sensitive data.
- Teams needing supplier controls for ISO 27001 (A.5.19 to A.5.22), SOC 2 or GDPR.
- Procurement teams that need a repeatable security review step.
What is included
- Supplier inventory and risk tiering.
- Tiered security questionnaire and evidence checklist.
- Review of SOC 2 reports, ISO certificates and questionnaire answers.
- Contract security clauses and Article 28 data processing terms.
- Ongoing review schedule for critical suppliers.
How it works
- 1Inventory. List suppliers and rate them by data access and business criticality.
- 2Assess. Send proportionate questionnaires and review the evidence returned.
- 3Contract. Agree security and data protection terms before signing.
- 4Monitor. Review critical suppliers yearly and after incidents.
Frequently asked questions
What should a vendor security assessment include?
The data the vendor will access, its security controls, certifications or audit reports, incident and breach history, sub-processors, data location and the contract terms that protect you.
Free resources
Work together
Share your role, contract or project and Ian will reply by email to discuss scope and timing.
Go to the request form