Reviews stall for a handful of repeat reasons: the vendor has not supplied a data flow, the tool was never tiered, questions arrive in several rounds, evidence is stale, ownership is unclear, or legal and privacy started late. Fix these at intake with one page and one owner.
Six causes and fixes
| Cause | What it looks like | Fix |
|---|---|---|
| No data flow | Privacy keeps asking what leaves the network | Ask the vendor for a diagram in week one |
| No tier | Heavy process for a light tool, or the reverse | Tier first, then pick the review depth |
| Rounds of questions | Each reviewer sends a separate list | Collect all questions in one pass |
| Stale evidence | Reports or policies out of date | Ask for dates, request current versions |
| Unclear owner | Nobody chases | Name one owner on each side |
| Late legal | Contract work starts after the pilot | Start in parallel |
Build a one page intake
Put this on one page before any vendor call:
- What the tool does and which teams will use it.
- What data it reads, stores and sends.
- How it connects: repository access, CI, SSO.
- The vendor's risk tier, with the reason.
- The required evidence list.
- The owner, reviewers and a target date.
The CISA Secure by Demand guide gives a useful starter set of buyer questions on single sign on, multi factor authentication, logging, vulnerability disclosure and SBOMs. Use it to avoid inventing a list from scratch, then add what is specific to code scanning.
Keep questions in one round
Send one consolidated request. Ask the vendor to respond with a single package: completed standard questionnaire, a recent independent report summary, data flow diagram, subprocessor list, and policy extracts. A second round should be follow up on gaps, not new topics.
If reviewers keep adding questions, set a cut off date after which new questions need a reason. See a lightweight vendor security review in one week.
Ask the vendor to help
A mature vendor has a trust page and a standard response pack. If they must write every answer from scratch, that is itself information. Ask what turnaround they have seen from other customers and what usually slows reviews on their side.
Escalate by risk, not by impatience
If a gap remains after two rounds, decide: accept with a compensating control, require a fix before go live, or stop. Write the decision down with an owner.
Timeline hygiene
Track the review in a visible list with dates: request sent, response received, review complete, decision. This makes delays visible and shows whether the vendor or your own team is the bottleneck.
Safeguard offers SBOM and dependency scanning and compliance evidence automation, with a free scan at gold.safeguard.sh/scan.
Quick check
What should you send a vendor first?
A one page intake that states your data concerns and asks for a data flow diagram and a completed standard questionnaire together.
Should every tool get the same depth of review?
No. Tier by access and data. A tool with access to all repositories deserves more depth than one reading public metadata.
Sources
Last reviewed: 19 October 2026.
