Do enough supplier due diligence to make the risk visible before the contract makes it expensive.

Ask for proof that matches the risk you are trying to understand.

Certifications can be useful evidence, but they should not become a universal substitute for technical and operational facts. A SOC report may support control assurance while still leaving unanswered questions about the exact hosted service, privileged support access, incident notification, customer log visibility, subcontractors, data deletion, or recovery.

Make the vendor-risk record usable during incidents, renewals, audits, and budget decisions.

A due-diligence package has limited value if it disappears after contract award. The organization should be able to answer, quickly and from one maintained record, what the supplier does, which systems and data depend on it, who owns the relationship, what access it holds, which upstream providers matter, what unresolved risks were accepted, and what evidence supported the last decision. This turns vendor risk from a procurement exercise into an operational control.

Separate facts from judgments. Record verifiable service attributes and evidence sources independently from the resulting risk rating or acceptance decision. When a supplier changes hosting, support access, subprocessors, ownership, product architecture, or recovery commitments, reviewers can then identify exactly which prior assumptions are no longer valid instead of repeating the entire assessment or, worse, assuming the previous result still applies.

Define evidence freshness by consequence. A critical identity provider or case-management platform may justify current recovery evidence, recent independent assurance, verified incident contacts, and frequent review of material dependencies. A low-impact commodity service may only require confirmation that scope and access have not materially changed. Proportional review reduces paperwork while concentrating effort where stale evidence would create the greatest operational uncertainty.

Use the record at renewal time as a decision brief, not a filing cabinet. Summarize open findings, incidents, service performance, material changes, accepted exceptions, cost or concentration concerns, continuity tests, and exit readiness. Renewal should confirm that the original reasons for accepting the dependency still hold and that new risks are either mitigated, explicitly accepted, or strong enough to justify replacement planning.

A supplier is not truly replaceable until the organization can recover its data, configuration, knowledge, and workflow.

Test export format, completeness, relationships, attachments, metadata, audit history, identity transition, integration replacement, documentation, and deletion evidence before the dependency becomes urgent. A CSV export does not necessarily reproduce the operational system.

For critical suppliers, define the conditions that trigger an exit assessment and who owns it. Insolvency, repeated security failure, unacceptable service degradation, strategic acquisition, loss of required certification, severe incident, or material pricing/contract change may all justify a fresh continuity decision.

Continue with the Software Continuity & Exit Readiness checklist for a detailed operational exit review.