Vendor assessment

Thank you for completing this assessment for your customer. These questions tailor it to the service you provide and are not scored.

1. Will you process personal data on your customer's behalf as part of this service?
2. Do you use sub-processors or subcontractors (such as cloud hosting or outsourced support) to deliver this service?
3. Is this a hosted, managed or software service your customer relies on to operate day to day?

The core controls that protect your customer's data and access.

1. Is multi-factor authentication enforced for all staff access to systems holding customer data, including remote and administrator access? Supplier: IT lead
2. Is customer data encrypted in transit and at rest, including on laptops and backups? Supplier: IT lead
3. Is access to customer data limited to staff who need it, reviewed regularly and removed promptly when people leave? Supplier: IT lead
4. How do you manage vulnerabilities in the systems that deliver this service? Supplier: security lead
5. When did all staff with access to customer data last complete security awareness training? Supplier: HR

From the help text

Stolen passwords are the most common route into a supplier. 'Yes' means MFA is enforced technically, not just recommended.

When you process personal data for your customer you act as their processor. GDPR Article 28 sets out what the contract between you must cover.

Asked only if you answer “Yes” to: Will you process personal data on your customer's behalf as part of this service?

1. Will you sign — or have you signed — a data processing agreement with this customer that meets GDPR Article 28? Knock-out Supplier: DPO or legal
2. Where is the customer's personal data stored and accessed from? Supplier: DPO or IT lead
3. Can you help the customer respond to data subject requests, and delete or return their data at the end of the contract? Supplier: DPO

From the help text

Article 28 requires a contract covering, among other things, processing only on documented instructions, confidentiality, security, sub-processor conditions, assistance with rights and breaches, deletion or return at the end, and audits. 'Yes' means an Article 28 agreement is in place or ready to sign.

Your customer needs visibility of who else is involved in delivering the service and handling their data.

Asked only if you answer “Yes” to: Do you use sub-processors or subcontractors (such as cloud hosting or outsourced support) to deliver this service?

1. Do you maintain a current list of sub-processors, showing what each does and where it processes data? Supplier: DPO
2. Do you notify customers before adding or replacing a sub-processor, and impose the same data protection obligations on sub-processors by contract? Supplier: DPO or legal

From the help text

Under GDPR, processors need the controller's prior authorisation to engage sub-processors. 'Yes' means a list the customer can see at any time.

If your customer relies on your service to operate, they need confidence you can recover from outages and cyber attacks.

Asked only if you answer “Yes” to: Is this a hosted, managed or software service your customer relies on to operate day to day?

1. Are backups of the service and customer data taken automatically, protected from ransomware (offline or immutable), and restore-tested at least annually? Supplier: IT lead
2. When did you last test your business continuity and disaster recovery plan for this service? Supplier: operations

From the help text

Untested backups often fail when needed. 'Yes' means all three, with a record of the last test.

Your customer may have a legal deadline of their own — for example 72 hours to notify the Data Protection Commission of a personal data breach — so they need to hear from you quickly.

1. Do you commit to notifying this customer without undue delay after becoming aware of a security incident or personal data breach affecting their data or service? Knock-out Supplier: security lead
2. Within how many hours of becoming aware of an incident affecting this customer would you notify them? Supplier: security lead
3. Do you have a documented incident response plan, tested in the last 12 months? Supplier: security lead
4. I confirm I am authorised to answer on behalf of the supplier and that these answers are accurate and complete to the best of my knowledge. Supplier: director or authorised signatory

From the help text

Processors must notify controllers of personal data breaches without undue delay. 'Yes' means a written commitment and a process to deliver it.