The vendor register template: every vendor, its risk and last review
Every vendor that touches your data, how critical it is, and when you last checked it.
A vendor register lists every vendor that touches your systems or data, how critical each one is, what data it holds, and when its security was last reviewed. It is the population every vendor control starts from.
The workbook is below with a short security questionnaire sheet. Start the list from your expense reports and single sign on apps so nothing is missed.
The template in full
Below is the whole workbook as it downloads. Every bracketed field, such as [Company name], is a detail to fill in before you adopt it. There is no form and no email address to hand over, and the file is yours to edit.
Vendor Register
Vendors
Each row is one vendor that stores, processes or can access [Company name] systems or data. Add a row before a new vendor is used, and update the review dates each time the vendor is reviewed.
| Vendor | Service provided | Data shared | Criticality | SOC 2 or ISO report on file? | Report date | Reviewed by | Last review | Next review | Contract end | Notes |
|---|
The sheet starts empty: one row per entry, under these columns.
Security questionnaire
Send this to a vendor that has no SOC 2 or ISO 27001 report. Record the answers, mark each one acceptable or not, and file the completed sheet with the vendor row.
| Section | Question | Vendor answer | Acceptable? | Reviewer notes |
|---|---|---|---|---|
| Security program | Do you have written information security policies approved by management and reviewed at least annually? | |||
| Security program | Who is responsible for security at your company? Give a name and title. | |||
| Certifications | Do you hold a current SOC 2 Type 2 report or ISO 27001 certificate? If so, please share it. | |||
| Certifications | Do your employees complete security awareness training at hire and at least annually? | |||
| Certifications | Do you run background checks on employees who can access customer data, where local law allows? | |||
| Encryption | Is our data encrypted in transit with TLS 1.2 or higher? | |||
| Encryption | Is our data encrypted at rest? Describe the method and how keys are managed. | |||
| Access control | Is multi-factor authentication required for all employee access to production systems and our data? | |||
| Access control | Is access to our data limited to staff who need it, and reviewed at least quarterly? | |||
| Access control | Is access removed within one business day when an employee leaves? | |||
| Access control | Do you support single sign-on and MFA for our users of your service? | |||
| Logging | Do you log access to systems holding our data, and how long are logs retained? | |||
| Logging | Are logs monitored for suspicious activity, and by whom? | |||
| Incidents | Do you have a documented incident response plan that is tested at least annually? | |||
| Incidents | Will you notify us within 72 hours of confirming a security incident that affects our data? | |||
| Subprocessors | Please list the subprocessors that store or process our data and their locations. | |||
| Subprocessors | Will you notify us before adding a new subprocessor? | |||
| Data location and deletion | In which countries and regions is our data stored and processed? | |||
| Data location and deletion | Will you return or delete our data within 30 days of contract end, and confirm deletion in writing? | |||
| Business continuity | Do you back up our data, how often, and when did you last test a restore? | |||
| Business continuity | Do you have a business continuity and disaster recovery plan, and what are your recovery time and recovery point targets? | |||
| Testing | Do you have an independent penetration test at least annually? Please share a summary of the latest results. | |||
| Testing | How quickly do you patch critical and high vulnerabilities? |
How to use
- [Security owner role] owns this register. Add every vendor before it is given access to company or customer data.
- Set Criticality. High: stores or processes Restricted or Confidential data, or an outage would stop the product. Medium: holds Internal data or supports important work. Low: holds no sensitive data and is easy to replace.
- High vendors: collect a current SOC 2 Type 2 report or ISO 27001 certificate, read the exceptions and the complementary user entity controls, and confirm you perform those controls. If no report exists, collect the completed Security questionnaire.
- Medium vendors: collect a report if one is offered, otherwise a completed questionnaire or the vendor security page saved as a PDF.
- Low vendors: record the vendor, its service and the data shared. No further evidence is needed.
- Review every High and Medium vendor at least once a year. Record Last review, set Next review twelve months later, and store the report or questionnaire in a shared folder linked from Notes.
- When a vendor is no longer used, confirm access is removed and data is deleted, then record the end date in Notes. Keep the row for the audit period.
What an auditor checks
An auditor picks vendors from the register and asks for each review: the SOC 2 report you read, or the questionnaire answers, and your notes. Critical vendors need a review in the last year.
They also check the register is complete by comparing it with what the company pays for. A vendor in the expense report but not here is a finding. The vendor security questionnaire is the deeper review for critical vendors.
Which criteria it maps to
It supports CC9.2.1 A template is evidence of intent. The examination tests whether the control operated over the period, so keep the dated records the workbook produces. Every criterion, explained one by one, is on the Trust Services Criteria page.
Questions
What is a vendor register?
Which vendors belong in a SOC 2 vendor register?
How often should vendors be reviewed?
Sources
Get audit-ready without a compliance team.
The readiness assessment is free, with no payment and no card. Star is $2,000 one time to get on the platform and close your gaps. Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year. You can be audit-ready starting at about a week.
Take the free assessmentPolara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.