Skip to content

Vendor Due Diligence

What is Vendor Due Diligence?

The investigation and evaluation of a potential vendor's security practices, financial stability, and compliance posture before establishing a business relationship.

Risk Management

Terms that appear alongside vendor due diligence

Each of these is named in at least one of the same controls as vendor due diligence. The number is how many controls name both.

Frameworks that govern vendor due diligence

PCI DSS v4.0View framework →NIST Cybersecurity Framework 2.0View framework →ISO 27001:2022View framework →

What the standards actually require on vendor due diligence

Requirements naming vendor due diligence across 3 standards, quoted from the control text.

Jamaica Data Protection Act 20202 controls

Sections 24-26 of the Jamaica DPA 2020 establish the framework for Joint Controllers + Processors + Sub-Processors + and Records of Processing Activities.

JM-DPA2020-Joint-Controller-Processor-Sec24-25-26-Arrangements-Allocation-Responsibilities-Contracts · Jamaica DPA 2020 Joint Controllers + Processors + Sections 24-26 + Arrangements + Allocation of Responsibilities + Contracts + Records of Processing Activities (ROPA) + Sub-Processors + Vendor Management →
IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)1 control

NSS-17 + NSS-42-G require supply chain + third party + OEM security across CBS lifecycle. Vendor due diligence: cyber maturity assessment + ISO 27001 / IEC 62443 / IEC 27036 alignment + cybersecurity governance + secure development + incident history + foreign...

IAEA-NSS17-SupplyChain-ThirdParty-OEM-Trust · IAEA NSS-17 - Supply Chain + Third Party + OEM + Vendor Security + Trustworthy Components →
Kentucky Consumer Data Protection Act1 control

Section 4(4)(a) of Kentucky CDPA establishes the heightened consent requirement for sensitive data processing. (1) Section 2 Sensitive Data Definition - 8 Categories: (a) Racial or ethnic origin; (b) Religious beliefs; (c) Mental or physical health diagnosis;

KY-CDPA-Sensitive-Data-Affirmative-Consent-Race-Religious-Health-Genetic-Biometric-Children-Citizenship · Kentucky CDPA Sensitive Data + Affirmative Consent + Race/Ethnicity + Religious + Mental/Physical Health + Sexual Orientation + Citizenship/Immigration + Genetic + Biometric + Children's Data + Precise Geolocation (1,750 ft) + Section 4 Heightened Consent Standard →

Questions people ask about vendor due diligence

What is Vendor Due Diligence?
The investigation and evaluation of a potential vendor's security practices, financial stability, and compliance posture before establishing a business relationship.
Why is Vendor Due Diligence important for compliance?
Vendor Due Diligence is a key concept in Risk Management. Understanding vendor due diligence helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Vendor Due Diligence?
Vendor Due Diligence appears in the requirement text of Jamaica Data Protection Act 2020, IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1), Kentucky Consumer Data Protection Act. Across these standards we have identified 4 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Vendor Due Diligence?
Explore our compliance framework pages to see how vendor due diligence applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Vendor Due Diligence applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.