Executive Summary
Every new tool or vendor you adopt becomes part of your daily operations and part of your attack surface. Checking them before you sign costs far less than unwinding a bad purchase or recovering from a vendor’s breach. This guide walks through a seven-step vetting process, a sample scorecard, and the questions to put to any vendor.
| Quick Facts | |
| Who is involved | The business owner of the tool, IT (or your managed services provider), finance, and legal or contracts |
| When to start | Before any contract is signed, and before a free trial touches real company data |
| Biggest risks | Data exposure, vendor breaches, lock-in, hidden costs, weak support |
| Typical timeline | About one to four weeks, depending on how sensitive the data is |
Why vetting matters
It is easy to buy software. A team lead finds a promising app, starts a free trial, and uploads a few client files. A month later it is in daily use and nobody in IT has reviewed it. This is how “shadow IT” happens, and it creates risk that the business never agreed to take on.
Attackers know this. Rather than breaking into hundreds of small businesses one by one, they target a single vendor and reach all of that vendor’s customers at once. When you choose a vendor, you are also choosing how well your data will be protected when you are not the one protecting it.
The seven-step vetting process
Step 1: Define the problem and your requirements
Write down what you need the tool to do, who will use it, and what data it will touch. Split requirements into must-haves and nice-to-haves, and set a budget based on total cost of ownership (licenses, setup, training, support, and renewal), not just the sticker price. Classify the data involved: public, internal, or sensitive (client records, financial data, health information).
Step 2: Research the vendor
- How long have they been in business, and who else uses them? Look for customers similar to you.
- Do they appear financially stable? A vendor that disappears can leave you without support or data.
- Search for past security incidents and how openly the vendor handled them.
Step 3: Review their security posture
- Independent audits such as a SOC 2 Type II report or ISO 27001 certification (ask to review under NDA).
- Support for single sign-on (SSO) and multi-factor authentication (MFA) for every user.
- Encryption of data in transit and at rest, role-based access controls, and audit logs.
- Regular penetration testing, a vulnerability disclosure process, and a stated timeline for notifying customers of an incident.
Step 4: Check data handling and privacy
Find out where your data is stored, who can access it, and which subcontractors touch it. Confirm that your data stays yours, that you can export it in a usable format, and that it is deleted when you leave. If you handle regulated data (for example payment card, health, or state privacy law obligations), confirm the vendor can support those requirements in writing.
Step 5: Test fit and integration
Check that the tool works with your identity system, backups, and key applications. Ask how much ongoing admin work it creates and how licenses are counted, so a few extra users do not trigger a surprise bill.
Step 6: Read the contract and the SLA
- Uptime guarantee and what the vendor owes you if they miss it.
- Support hours and response times for urgent issues.
- Liability limits, breach notification terms, and who pays if your data is exposed.
- Auto-renewal clauses, price increase caps, and the process (and cost) of terminating and getting your data back.
Step 7: Pilot, check references, then decide
Run a small pilot with non-sensitive data and a few users. Test the vendor’s support by asking a real question. Speak with two or three current customers, then score each finalist using a consistent method like the sample below.
Sample: weighted vendor scorecard
Adjust the weights to match your priorities. Score each criterion from 1 (poor) to 5 (excellent), multiply by the weight, and add up the results.88
| Criteria | Weight | Score (1–5) | Weighted score |
| Security and compliance | 25% | 4 | 1.00 |
| Data handling and privacy | 20% | 4 | 0.80 |
| Functionality and fit | 20% | 5 | 1.00 |
| Support and SLA | 15% | 3 | 0.45 |
| Total cost of ownership | 10% | 3 | 0.30 |
| Integration and admin effort | 10% | 4 | 0.40 |
| Total (Vendor A, example) | 100% | 3.95 / 5 |
Questions to ask every vendor
- Can we review your current SOC 2 Type II report or ISO 27001 certificate?
- Do you support SSO and MFA for all users, including admins?
- Where is our data stored, and who on your team can access it?
- How quickly will you notify us of a security incident?
- Which subcontractors handle our data?
- If we cancel, how do we export our data, and when do you delete it?
- What was your uptime over the past 12 months, and what is your support response time?
| Red Flags: Pause Before You Sign The vendor will not share any security documentation or audit results. You are pressured to sign by the end of the month to “lock in” a discount. There is no MFA option, or the vendor is vague about where your data lives. No clear way to export your data or end the contract. The vendor cannot provide customer references or commit to a breach notification timeline. |
How this maps to real attacker behavior
| MITRE ATT&CK technique | ID | Why vendor vetting matters |
| Supply Chain Compromise | T1195 | Attackers target software and vendors to reach their customers |
| Trusted Relationship | T1199 | A vendor’s access to your systems can be abused as a way in |
| Valid Accounts | T1078 | Weak vendor credential practices lead to account takeover |
| Data from Cloud Storage | T1530 | Poorly secured vendor storage can expose your data |
| Pro Tip: Keep a vendor inventory List every vendor, what data they hold, who owns the relationship, and the renewal date. Re-review high-risk vendors once a year. A vendor that passed review three years ago may not meet today’s standards. |
| Want a second set of eyes before you buy? AvantGuard’s Technology Procurement and IT Services teams can help you evaluate vendors, review security documentation, and choose tools that fit your business and your risk. Stay secure and innovative. Web: www.avantguard.it | Email: info@avantguard.it |
