Vendor due diligence

This is an evidence and routing check, not a certification.

Build the checklist from the purchase

Use the data, access, geography, service criticality, spend, and policy thresholds in the requirements brief. Assign each check to its real owner:

• security controls and test reports to security;
• personal-data terms and locations to privacy;
• insurance to the policy owner;
• financial evidence to finance or procurement;
• contract terms to counsel;
• service history and references to the business owner.

Record evidence

For each item, keep the vendor claim, document name, scope, issuer, date, expiry, relevant passage, reviewer, status, and open question. Use PRESENT, MISSING, EXPIRED, OUT OF SCOPE, or REVIEWER DECISION.

Do not call a vendor secure, compliant, solvent, safe, approved, or low risk. Do not accept a badge or summary as proof beyond its stated scope.

Output

Return the evidence register, missing items, conflicts, and a reviewer queue with due dates. Only the named reviewers decide whether evidence clears their gate.