Source: [LinkedIn](https://www.linkedin.com/pulse/assessing-security-product-vendors-ask-gerardus-blokdyk/)  
Author: [Gerardus Blokdyk](https://www.linkedin.com/in/gerardblokdijk/)  
Publication date: January 2, 2022  
Retrieved from on January 10, 2022

Relevant ISO 27001 clauses/controls:
- [[ISO 27001 A 14.1.1 Information security requirements analysis and specification]]
- [ISO 27001 A 15 Supplier relationships](../../Standards/ISO27x/legacy/ISO%2027001%202013/ISO%2027001%20A%2015%20Supplier%20relationships.md)
- [ISO 27001 2013 C 9.2 Internal audit](../../Standards/ISO27x/legacy/ISO%2027001%202013/ISO%2027001%202013%20C%209.2%20Internal%20audit.md)
- [ISO 27001 A 18 Compliance](../../Standards/ISO27x/legacy/ISO%2027001%202013/ISO%2027001%20A%2018%20Compliance.md)

Related:  
- [Examples of vendor selection questionnaires](../../🎇%20Sparks/Examples%20of%20vendor%20selection%20questionnaires.md)

# Assessing Security Product Vendors? Ask this:
1.  When a faulty product is to be returned, what processes does the vendor have in place to ensure that no customer data exists on disks or storage before it is sent to one of return centers?
2.  What security measurement practices and data does your organization use to assist product planning?
3.  Does your organization have a software assurance program?
4.  What release criteria does your organization have for its products with regard to security?
5.  What processes does the vendor have in place to assess the conformity of the suppliers to any security clauses or agreements?
6.  What capabilities does the practice have in terms of security knowledge and expertise?
7.  What governance structure does the vendor have in place that demonstrates that cybersecurity is a core strategic and operational focus of the business?
8.  How much will you have to clean your data for it to be used by your software?
9.  What data does your organization use to prepare against a cyber attack?
10.  Is there out of the box data integration or does the vendor need to create a program interface?
11.  How does your organization predict how many problems there will be in a given time frame?
12.  Did the vendor have to make any system and process changes to support GDPR?
13.  Do you currently have a personal data security breach management policy and procedures?
14.  Who will have access to your organizations data?
15.  How does the data collected from your devices need to be governed?
16.  Where and how does the data need to be stored?
17.  How does the vendor trace all defects and ensure that the defect has been fixed in every product that might use that component?
18.  Do you have a formal incident response and data breach notification plan and team?
19.  How does the data get from the source to the end recipient?
20.  How many staff have been trained on GDPR and data privacy?
21.  How does your organization have data driven conversations with vendors?
22.  Do you have a policy for dealing with data protection issues?
23.  Does loss or misuse of the data have the potential to affect an individual?
24.  Does your organization have contact information sorted and identified for each type of incident?
25.  Does your organization have a documented information security strategy?
26.  How does the supplier help the customer integrate products and services into existing infrastructure safely and securely?
27.  How does the vendor ensure that sales only sells products and services that comply with local laws and regulations, including any export controls or trade sanctions?
28.  Does your organization have a process in place to ensure the safe and proper use of internet and email?
29.  Does your organization have a portion of its IT budget specifically allocated for information breach detection, response and notification costs?
30.  How much training data do you have that is relevant to your desired application?
31.  How does the vendor ensure that the service or support engineers cannot tamper with installed software or install vulnerable or malicious software?
32.  When introducing new technologies, does your organization assess potential information security risks?
33.  Do you have a process to manage access to sensitive information which includes timely account termination?
34.  What approach does the vendor take to ensure that every part of the business considers the impact of security?
35.  Does your organization own the physical data center where the institutions data will reside?
36.  Does the vendor have the ability to provide support to users?
37.  How much ownership will you have over your solution?
38.  What type of information does your organization maintain about itself and others?
39.  How much system downtime does your organization tolerate?
40.  Does the vendor have experience in producing high quality information security products?
41.  Do you have a vendor risk management process in place for your critical vendors?
42.  Is redundant power available for all data centers where organization data will reside?
43.  What information specifically was or may have been compromised?
44.  Where does the service store the data, and who has access to it?
45.  How will data be returned to your organization and in what format?
46.  How could information sharing with other organizations have been improved?
47.  Will the licensor have to perform which set of security audits when the system goes into production?
48.  How does the incorporation of AI impact the performance your product and its use of enterprise and endpoint resources?
49.  What services does the incident response team provide?
50.  Do you have vendor maintenance support for software products?
51.  How will the vendor help you respond to data subject rights requests?
52.  Do you have a security patch management cycle in place to address identified vulnerabilities?
53.  What impact could heightened physical security controls have on the teams responses to incidents?
54.  Do you have documented and tested plans for business continuity and information recovery?
55.  What procedure and technology does the vendor use to ensure the right components are used at the right time?
56.  Do your vendors have appropriate governance, organizational design, policies and procedures to support the strategies?
57.  Which security leadership roles does your organization have?
58.  How does your organization determine how identified risks are mitigated in product offering design?
59.  Does your organization have the appropriate controls to detect and prevent an insider attack?
60.  How does your security help drive broader business outcomes?
61.  Do you have a contingency plan in place to handle emergency access to the software?
62.  Does your organization have a budget formally allocated for any AI initiatives and if so, how much?
63.  What have you done to protect your organization against third party cyber risks?
64.  What does your organization consider in its cyber risk assessment/measurement?
65.  How long does it typically take your organization to mitigate and stop an insider attack?
66.  Does your software or system have automatic logoff for inactivity?
67.  Do you have a cyber focused mindset and cyber conscious culture organization wide?
68.  How would remote work impact the cost of a data breach?
69.  Do you have an approved and documented information security strategy in place?
70.  How does your organization measure/monitor whether its security controls are working?
71.  Does the vendor have the right to use your data?
72.  How does the nature of the product or service implicate information security?
73.  Does your organization have a dedicated budget for the effort?
74.  How long does it typically take your organization to detect an insider attack?
75.  How does your organization keep abreast of software vulnerabilities?
76.  How would remote work impact your ability to respond to a data breach?
77.  Does the vendors product or service have a mechanism for user authentication and authorization?
78.  How does your organization simultaneously protect employee rights/privacy and reassure clients?
79.  Will a single support analyst be able to address issues across the vendors entire product range or will different products require separate, time consuming conversations?
80.  What role does a service mesh play in security policy?
81.  How does access to the device need to be managed?
82.  Does your organization have a CISO or equivalent?
83.  What does your organization do to gain software assurance?
84.  Do you have security experts that work with developers for every application?
85.  Does the vendor have a product lifecycle strategy that ensures the product is maintained from a security perspective over its life?
86.  Do you have an incident response team ready to help your customer?
87.  Does the vendor have a realistic business continuity or disaster recovery plan?
88.  Do you have a plan to log and store historical predictions if a consumer requests access in the future?
89.  How does your organization monitor its production database servers to detect suspicious activity?
90.  How does your organization communicate the policies to all staff, vendors, and customers?
91.  What training resources does the vendor provide as part of the product?
92.  Do you have a process to identify new laws and regulations with IT security implications?
93.  How does your organization keep up with compliance maintenance?
94.  When does your organization ask people for sensitive information?
95.  What vendors does your organization utilize for complementary services/products?
96.  Do you have a list of the most common vulnerabilities/bugs that need to be eliminated?
97.  Do you have an enterprise wide, independently budgeted cyber risk management team?
98.  Do you have a process for tracking and tracing your product while in development and manufacturing?
99.  How does the ecosystem advance ideas about the need for and value of assurance?
100.  Does the vendor have the mechanism to allow external stakeholders or the delegated organizations to conduct the audit?