Vendor self-service due-diligence questionnaires

A.5.20 sits alongside A.5.19's general supplier risk management: A.5.19 covers assessing and managing supplier risk, A.5.20 covers actually agreeing requirements with the supplier directly. An internal guess at a vendor's practices satisfies neither as well as the vendor's own confirmed answer does.

Due diligence that never reaches the vendor also tends to go stale silently: a vendor's practices can change without your organisation ever finding out, unless you have a repeatable way of asking them again.

The same risk questionnaire used for internal assessment can be sent directly to a vendor's own contact by email, as a secure, single-use link. No account or login is required on the vendor's side.

The vendor answers it themselves through a plain, unbranded page built for exactly this purpose. Their responses feed the same risk score as an internal assessment, but the evidence trail now shows the vendor's own answers rather than an internal guess.

Every link sent is tracked as pending, completed, or revoked, so a mistyped email address or a vendor who never responds is visible immediately rather than discovered at renewal or audit time.