Prepare a security and procurement review

Tell us your review process early

Let us know if your organisation needs vendor onboarding, a security questionnaire, an NDA, data-processing terms, or specific approvals. Share the requested categories and deadlines first. Project-specific evidence is supplied through an agreed channel when available and appropriate.

Useful questions to cover

• Which information is processed, why, and by which providers or systems?
• Who has access, how are permissions controlled, and which actions are logged?
• What are the agreed retention, deletion, backup, and recovery arrangements?
• What are the incident contact, human approval points, and service limitations?
• Which certifications or assurances are required, and what evidence can actually be supplied?

Keep requirements tied to the project

A questionnaire helps identify requirements; it is not proof that a control is implemented. Any required residency, private deployment, response time, or certification must be checked and documented for the actual engagement.