Vendor assessment procedure: stages and deadlines

A vendor assessment procedure for data and security runs in five stages: intake, questionnaire, document review, risk scoring and sign-off. Most vendors clear the process within two to four weeks. The point of no return is the risk score: once logged, reopening the file needs a documented exception, not a casual re-check.

Practical consequence

Skipping a stage does not save time. It moves the delay downstream, usually to the point where the vendor is already handling data and the questionnaire is still outstanding. Contracts signed before the risk score is logged create the same problem in reverse: the commercial team has committed, and the security review starts from a weaker position. Sequencing matters more than speed at any single step.

What to do

1. Intake. The requesting team sends the vendor name, service description and data categories to the assessment owner, in writing, before any contract draft circulates.
2. Questionnaire. Legal or compliance issues the security and data protection questionnaire within two working days of intake. The vendor is the one who completes it, not the requesting team on the vendor's behalf.
3. Evidence collection. The vendor returns certifications, its sub-processor list and any breach history. Missing evidence is a reason to pause, not to estimate.
4. Contract alignment. The reviewer checks the vendor's proposed terms against the standard security annex. This is a separate exercise from the assessment itself — see Contract review against a security annex: stages and deadlines for how that review runs on its own clock.
5. Risk scoring. The risk owner scores the vendor against the standard criteria and logs the file. This is the step that closes the door on informal changes.
6. Sign-off. The data protection lead approves the file or escalates it. Escalation itself has a deadline; silence past it counts as a hold, not an approval.

Who decides

The risk owner scores the vendor. The data protection lead signs off on standard-risk files. Anything scored high-risk moves to management, and management's decision is the one that determines whether onboarding proceeds. No single reviewer can override a high-risk score without that escalation.

Forks

If the vendor's platform embeds third-party licensed technology, the assessment does not stop at security. Check whether the underlying licence has been recorded and is current, because an unrecorded licence is a supply risk in its own right — the mechanics of that check are covered separately in How recordal of a licence IP licence runs in.

If the assessment surfaces a personal or financial connection between the vendor and an internal stakeholder, the file does not proceed on the standard track. Log the connection in the conflict of interest register before scoring continues; the steps for that entry are set out in Conflict of interest register step by step in practice.

If the vendor refuses to return the questionnaire within the agreed window, the file is paused, not scored on incomplete information. A pause is not a rejection; it is a hold that the requesting team can lift once evidence arrives.

Limit

This procedure covers onboarding and periodic re-assessment. It does not cover disputes with a vendor once it is already engaged, and it does not cover competitor conduct outside the vendor relationship at all. A situation such as a rival launching a design-around runs on an entirely different clock, described in When a rival launches an obvious workaround: the deadline. The two procedures do not share a deadline or a decision-maker.

This page also does not set out what a supervisory authority expects once it starts asking questions about a vendor already under contract. That sequence follows its own stages and is covered separately.

Verified

This page describes an internal procedural sequence, not a statutory obligation. No article, regulation or directive is cited here, because the underlying national implementation record for this topic is not yet complete on our side. The stage sequence and typical durations reflect current internal practice and were last reviewed for this page's publication date.

Related reading: Supervisory correspondence: stages and deadlines sets out what happens once a vendor question turns into a regulator question.

FAQ

How long does vendor assessment procedure take in practice?

Two to four weeks for a standard-risk vendor, from intake to sign-off. High-risk files that need management escalation typically add another one to two weeks.

Which documents are needed to start?

Intake needs the vendor's name, a description of the service and the categories of data involved. The questionnaire, certifications and sub-processor list follow once the vendor responds; none of them are required to open the file.

What happens if the other side does not respond?

The file is paused, not scored on partial information. A pause has no fixed expiry; it lifts once the vendor returns the outstanding evidence, and the requesting team is the one who tracks that follow-up.

— Rasa Tumenaite, AURELIS