---
title: "Vendor assessment"
canonical: "https://auditbadger.com/nl/functies/leveranciersbeoordeling/"
last-updated: "2026-09-05"
---

# Vendor assessment

Third-party risk management — vendor register, risk-based tiering, security questionnaires, secure vendor portal, SLA monitoring, and full assessment audit trail. Required for ISO 27001 controls A.5.19–A.5.23.

## What it does

| Capability | Detail |
|---|---|
| **Vendor register** | Centralized list of all third parties with risk tier, owner, status |
| **Risk-based tiering** | Auto-tier vendors as **Low / Medium / High** based on data access, business criticality, and integration depth |
| **Customizable questionnaires** | Different question sets per risk tier |
| **Secure vendor portal** | Branded portal where vendors complete questionnaires and upload documents |
| **Findings and remediation** | Track gaps, remediation tasks, and resolution dates |
| **Evidence requests** | Request specific documents (SOC 2 reports, ISO certificates, pen-test results); track receipt |
| **SLA monitoring** | Automated follow-up reminders for missed deadlines |
| **Reassessment cycles** | Configurable cadence per tier (quarterly / semi-annual / annual) |
| **Audit trail** | Every assessment, response, finding, and decision is timestamped |
| **Risk scoring trends** | Vendor risk evolution over time |

## Tier defaults

| Tier | When to use | Questionnaire | Cycle | Evidence required |
|---|---|---|---|---|
| **Low** | Minimal access to sensitive data or critical systems | 10–15 questions | Annual | Self-attestation acceptable |
| **Medium** | Moderate data access or business-critical function | 30–40 questions | Semi-annual | Documented evidence required |
| **High** | Extensive access to sensitive data or critical infrastructure | 60+ questions | Quarterly | Third-party certifications required |

## Vendor portal experience

- Branded email invitations with secure access links
- Multi-factor authentication for vendor login
- Auto-save lets vendors complete assessments across sessions
- Drag-and-drop document uploads
- Smart form validation and tooltips for complex questions
- Automated reminder emails for pending or overdue items

## Standards alignment

| Framework | Reference |
|---|---|
| **ISO 27001:2022** | A.5.19 (Information security in supplier relationships), A.5.20 (Addressing security in agreements), A.5.21 (Managing security in ICT supply chain), A.5.22 (Monitoring and review), A.5.23 (Information security for cloud services) |
| **SOC 2** | CC9 (Risk mitigation), CSOCs (subservice org carve-out documentation) |

## Useful links

- Sign up: [auth.auditbadger.com/signup](https://auth.auditbadger.com/signup)
- All features: [/features](/features)
- Risk assessment (companion module): [/features/risk-assessment](/features/risk-assessment)
- Assessment management (questionnaire engine): [/features/assessment-management](/features/assessment-management)
- ISO 27001 deep dive: [/compliance/iso27001](/compliance/iso27001)