Security review of a supplier
A technical review for the person who has to sign off the risk: how the thing is built, who can reach your data, what happens when something goes wrong, and which answers can be checked rather than believed.
Certifications tell you a supplier has a management system. They do not tell you how the product is built or who inside the supplier can read your data. This list is for the second question. Most of it can be answered in a single call with an engineer — and whether the supplier will put an engineer on that call is itself a finding.
How it is built
Is the system multi-tenant, and what enforces separation between tenants?
Deal-stopperShared infrastructure is normal and fine. What matters is whether separation is enforced by the database and the authorisation layer, or by application code remembering to filter.
Ask for: An architectural description of the isolation boundary, and whether it has been specifically tested.
Red flags
- Separation by application filtering alone
- Never tested for cross-tenant access
- Question deflected to the certification
What is encrypted at rest and in transit, and who holds the keys?
Deal-stopperEncryption at rest with supplier-held keys protects against a stolen disk, not against the supplier. Knowing which threat you have covered is the point.
Ask for: Algorithms, what is covered, key management, and whether customer-managed keys are available.
Red flags
- At rest unencrypted
- Keys alongside the data with no separation
- Internal traffic unencrypted
How are secrets and credentials managed?
Deal-stopperCredentials in source control or configuration files is the most common way a competent-looking system is quietly compromised.
Ask for: A secrets manager, rotation policy, and scanning of repositories.
Red flags
- Secrets in config files
- No rotation
- Shared accounts between environments
Is production data ever used in development or test environments?
Deal-stopperIt is common, rarely disclosed, and puts your data in the least protected part of the estate.
Ask for: A written statement, and the anonymisation approach where copies are made.
Red flags
- Production copies in test
- Anonymisation is only field masking
- Developers hold local copies
Who can reach your data
Which of the supplier's staff can read customer data, under what approval, and is it logged?
Deal-stopperSupport engineers can usually see more than customers assume. The control that matters is whether access is granted per incident and recorded, not whether it exists.
Ask for: The internal access model, approval process, and whether customers can see the access log.
Red flags
- Standing access for a broad group
- Access not logged
- Customers cannot be told who looked
How quickly is access removed when someone leaves?
ImportantOffboarding is where access control most often decays, and the answer is usually a number the supplier either knows or has never measured.
Ask for: The process, the target, and the last review of dormant accounts.
Red flags
- No target
- Manual and unmonitored
- No periodic access review
Is administrative access protected by phishing-resistant multi-factor authentication?
Deal-stopperMost intrusions still start with a credential. The distinction between any MFA and phishing-resistant MFA is the one that matters for privileged accounts.
Ask for: The authentication method for administrative access.
Red flags
- SMS or code-based MFA for admins
- Break-glass accounts without MFA
- Shared admin credentials
What can we enforce on our own users — SSO, session limits, IP restrictions, audit log export?
ImportantYour controls end where the supplier's configurability does, and audit log export is what lets your own monitoring see anything at all.
Ask for: Available controls by plan, and whether logs can be streamed to your systems.
Red flags
- No audit log export
- SSO gated behind a large premium
- No session control
Evidence you can check
What is the certificate number, and does the register confirm it?
Deal-stopperCertificates are published on registrars' registers. Checking takes a minute and occasionally finds a scope that excludes the product, or a certificate that has lapsed.
Ask for: The certificate number, verified on the registrar's own register by you.
Red flags
- Number not provided
- Register shows a different scope
- Registrar not accredited
Was the last test authenticated, and did it cover the application as well as the infrastructure?
Deal-stopperAn unauthenticated infrastructure scan sold as a penetration test is common. Authenticated application testing is where the findings that affect you live.
Ask for: Scope and methodology from the test report, plus remediation status of findings.
Red flags
- Unauthenticated scan only
- Findings unremediated with no dates
- Scope excludes the product
How are third-party dependencies tracked and patched?
Deal-stopperMost code in any product is somebody else's. The question is whether the supplier knows which somebody, and how fast it moves when one of them is compromised.
Ask for: Dependency scanning, a software bill of materials if one exists, and the patch target for a critical vulnerability.
Red flags
- No dependency scanning
- No patch target
- Cannot produce a component list
Is code reviewed before it ships, and can anyone deploy to production alone?
ImportantA single person able to push unreviewed code to production is both a security control gap and an availability risk.
Ask for: Branch protection, review requirements, and the deployment approval path.
Red flags
- Direct pushes to production permitted
- Review optional
- No separation between who writes and who approves
When something goes wrong
Who is on call, how are you paged, and when was the process last exercised?
Deal-stopperAn incident response plan that has never been run is a document. The last exercise date is the honest measure.
Ask for: On-call rota, escalation path, and the date and outcome of the last exercise.
Red flags
- Plan never exercised
- No formal on-call
- Escalation depends on one individual
What would detect an intruder, and how long would it take?
Deal-stopperPrevention fails eventually. Detection capability is the difference between an incident and a long, quiet breach.
Ask for: Logging coverage, alerting, retention period for logs, and whether anyone watches them out of hours.
Red flags
- Logs retained under 90 days
- No alerting on anomalous access
- Nobody monitors out of hours
When did you last restore from backup, and how long did it take?
Deal-stopperBackups are universal; tested restores are not, and the gap is only ever discovered at the worst moment.
Ask for: Date of the last restore test and the measured time to recover.
Red flags
- Never tested
- Restore time unknown
- Backups in the same failure domain as production
How quickly would we be told, and by whom?
Deal-stopperYour own obligations start when you know. This is the clause that sets that moment.
Ask for: A contractual notification period and a named contact.
Red flags
- No period
- Notification via a status page only
- Discretionary notification
This checklist is general guidance, not legal, security or financial advice, and it does not replace your own advisers on anything contentious. It was last reviewed on 19 September 2026. Tell us if something here is wrong or missing.