Vendor Due Diligence
The assessment process conducted before engaging a third-party vendor, evaluating their security posture, financial stability, compliance status, and operational reliability. Due diligence happens before the contract. Ongoing monitoring happens after.
Why it matters
Onboarding a vendor without due diligence is accepting unknown risk. You are granting access to your data, systems, or processes based on trust rather than evidence. Due diligence surfaces red flags early: missing certifications, weak security practices, jurisdictional risks, or financial instability. Discovering these issues after signing a contract is exponentially more expensive than discovering them before.
In practice
Vendor due diligence involves sending security questionnaires, reviewing certifications (ISO 27001, SOC 2), checking sub-processor arrangements, evaluating data processing agreements, and assessing business continuity capabilities. The depth of assessment should match the risk: a critical data processor gets more scrutiny than a stationery supplier. In vucavoid, third-party records support structured assessment workflows with risk and reliability scoring, ensuring every vendor is evaluated proportionally to the risk they introduce.