You can review a new vendor in a week by spending day one on scope, days two and three on evidence, day four on gaps, and day five on a recorded decision. The key is proportion: the more sensitive the data and access, the deeper each day goes.
Day 1: Scope and tier
Ask the requesting team three things: what the vendor will do, what data it will receive, and which systems it will connect to. Decide the tier from the answers. If it handles no sensitive data and has no access, a short review is enough and you can stop at day two.
Day 2: Request evidence
Send a short request, not a long questionnaire. For a mid tier vendor the list might be:
- A current independent audit report or equivalent
- A summary of the latest penetration test
- The data processing agreement or security terms
- A description of subprocessors and data location
- Their breach notification commitment
Day 3: Check public signals
While waiting, look at what you can see without asking. Check the vendor's security page and trust center, any published advisories, and whether the product shows up in the CISA KEV catalog. Note the vendor's ownership and how long it has operated.
Day 4: Read and score the gaps
Compare what arrived with what the tier requires.
| Finding | Typical response |
|---|---|
| Requirement met, evidence current | Note and move on |
| Met, evidence old | Ask for a refresh or a bridge statement |
| Not met, low impact | Accept with a recorded reason |
| Not met, high impact | Ask for a fix, a contract clause or a compensating control |
| Vendor will not answer | Treat as a gap, and escalate if the tier is high |
Day 5: Decide and record
Give one of three answers: approve, approve with conditions, or decline. Write the decision, the conditions, the evidence list with dates, the owner and the next review date. Share it with the requesting team in plain words.
What a one week review cannot do
It cannot substitute for a deep assessment of a critical vendor, such as a payment processor or a platform with production access. If the tier is high, use the week to decide how deep to go, and plan the longer work. Also keep the integration scope narrow in the meantime.
Tips that save time
- Keep a standard evidence request per tier so you never start from scratch.
- Reuse prior answers with a review date. See building an answer library.
- Agree a service level with the business, so they know the week is a promise.
- Give a fast answer to low risk requests. Slow reviews push people toward unapproved tools.
Quick check
Is one week enough for every vendor?
No. It suits low and mid tier vendors. For critical vendors, treat the week as the first phase and schedule a deeper review.
What if the vendor needs three weeks to send evidence?
Say so in the decision. You can approve a limited trial with conditions, or hold the rollout until the evidence arrives.
Safeguard's compliance and evidence automation can keep your side of this record organized, and a free scan is at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
