Somewhere in your contract with a vendor there is a paragraph that says they will protect your data the way you have to protect it. If you're a defense contractor, it's the DFARS 252.204-7012 clause and NIST SP 800-171. If you're a hospital, a practice or a billing company, it's a page of safeguards your lawyer added. Either way, the vendor signed it.
That paragraph is a promise, not a control. The work that actually protects you happens after the signature: finding out whether the vendor can keep the promise, writing down who does what, and checking it again when things change. Most companies skip all three, because the contract feels like the finish line.
Here's how to do it without turning every vendor into a six-month project.
First, be clear about what you're flowing down
"Flow down" just means you pass your own obligations on to the people who help you do the work. In defense, some of it is required. DFARS 252.204-7012 says you have to include the clause in subcontracts that involve covered defense information. DFARS 252.204-7020 says you can't award a subcontract that's subject to it unless the sub has a current NIST SP 800-171 assessment on file in SPRS. And the CMMC clause, DFARS 252.204-7021, flows the required CMMC level down too.
In healthcare, the floor is set by law. Before a vendor creates, receives, stores or sends patient information for you, HIPAA requires a signed agreement (the formal name is a business associate agreement) in which the vendor promises to safeguard the data, report incidents and breaches to you, and hold its own subcontractors to the same terms. Like the DFARS clause, it's a promise, not proof. HHS has proposed requiring vendors to give written verification of their safeguards at least once a year. That isn't final yet, but it's the rest of this post in rule form.
Before you vet anyone, write down in one sentence what the vendor actually has to protect and why. "They store our CUI drawings for machining." "They log in to our billing system to work denials." If you can't say it in one sentence, you're not ready to evaluate them, because you don't yet know what good looks like.
The 30-minute check
You don't need a 300-question spreadsheet. Most vendors who are going to fail, fail on the same handful of basics. Put these to them on a call, not in a form, and ask to see the answer, not just hear it.
- Who can get in, and how do they prove it's them? Is multifactor authentication on for everyone, including admins and remote access? Ask for a screenshot of the setting, not a yes.
- What's on the computers that touch your data? Are those devices managed by the company, kept up to date and encrypted? Or is it "people use their own laptops"?
- Who is watching? Is anyone reviewing logs and alerts: an internal person, an MSP or a security operations service? What happens at 2 a.m. on a Saturday?
- Where does your data live? Which systems, which cloud services, which countries? Who else (their vendors) can see it?
- How fast will you hear about a problem? What's the notification window in practice, who will call you, and do they have your after-hours contact?
- For defense subs: what's in SPRS? You can't look a supplier up yourself. Ask them to send a screenshot of their SPRS record with the score and the date, and ask when their plan of action closes.
Rank the answers simply: clear evidence, a credible answer without evidence, or a shrug. A vendor with two shrugs on the first three questions is telling you something important, and it's better to hear it before they're connected to your network.
Write down who does what
This is the step almost nobody does, and it's the one that saves you in an incident or an assessment.
Make a one-page responsibility list for each vendor that matters. For every area that touches your data, write down who owns it: you, the vendor, or a third party like their cloud provider. Something like this:
| Area | You | Vendor | Their provider |
|---|---|---|---|
| Accounts and access for vendor staff | Approve and review | Request, remove when people leave | |
| Multifactor authentication | Require it | Enforce it | Provides the feature |
| The connection between you | Firewall rules on your side | Their end, kept patched | |
| Logs | Keep yours | Keep theirs, share on request | Platform logs |
| Incident notice | Your reporting clocks | Tell you within the agreed time | Tell the vendor |
It looks obvious on paper. In practice, the gaps show up the minute you try to fill it in: two parties who each assumed the other was reviewing access, or a remote access tool nobody remembers approving.
Map the connections, not just the companies
Vendors don't only hold your data. Many of them connect to you: site-to-site VPN tunnels, remote support tools, shared accounts in your systems, integrations that move data automatically.
On a recent engagement, a network diagram listed secure tunnels to several outside sites. It was a good diagram. What nobody could say was which of those tunnels were still in use. Every live connection is a door, and a door nobody knows is open is the most dangerous kind.
For each vendor, list every way they connect to you, who on your side owns that connection, and when it was last confirmed as needed. Close the ones nobody can justify. You will almost always find at least one.
Verify, then check again when things change
A questionnaire tells you what the vendor believed on the day they filled it in. Evidence tells you what's true: a screenshot of a setting, a recent access review, a report from their monitoring service, a current certificate or assessment.
Then put the vendor on a schedule based on how much they matter. The ones that hold your most sensitive data or connect to your network get a real review every year. The rest get a lighter check. And everyone gets re-checked when something material changes: a new service, a new connection, a merger, an incident, or a change in what you're asking them to protect.
The short version
- Say in one sentence what the vendor has to protect, and make sure the right agreement is signed before they touch it.
- Ask the basic questions on a call, and ask to see the answers.
- Write down who does what, on one page.
- List every connection and close the ones nobody can justify.
- Keep evidence, and check again when things change.
None of this needs special software. It needs someone who owns it and does it on purpose. If that's nobody in your organization right now, that's exactly the gap our supplier security reviews and vCISO service are built to fill. You can also start with the free supplier quick check.
