Vendor Due Diligence Patrick Munro

Vendor Due Diligence Framework

Overview

Risk-based vendor assessment framework that identifies material risks early, ensures DORA/NIS2/GDPR compliance, and provides clear recommendations for selection, contract calibration, and ongoing management. Built for regulated sectors (financial services under DORA, KRITIS sectors under NIS2) and for any organisation with meaningful ICT third-party exposure.

LEGAL DISCLAIMER

This skill provides frameworks for vendor assessment purposes only. It does not constitute legal, financial, or professional advice. Users should:

• Consult qualified legal counsel for specific requirements in their jurisdiction;
• Engage financial and security professionals for detailed assessments;
• Verify all regulatory requirements independently;
• Adapt frameworks to specific organisational needs and risk tolerance;
• Not rely on this skill as a substitute for professional due diligence services.

The frameworks are templates. Actual assessments require expertise in law, finance, cybersecurity, and risk management. Neither the skill creator nor Claude/Anthropic assumes liability for decisions made based on this skill's output.

Regulatory references current as of 2026-04-23. EU (DORA, NIS2, GDPR) and German (NIS2UmsuCG, BDSG) citations reflect the consolidated text available at that date. Member State NIS2 transposition remains uneven; Germany's NIS2UmsuCG entered into force on 6 December 2025 with the BSI reporting portal opening on 6 January 2026. Verify the current consolidated text and national transposition status on EUR-Lex and the Bundesgesetzblatt before use.

When to Use This Skill

• Evaluating new vendors, technology providers, or service partners;
• Conducting critical ICT third-party due diligence under DORA Art. 28-30;
• Supply chain security assessment under NIS2 Art. 21(2)(d);
• GDPR Art. 28 processor due diligence;
• Vendor onboarding documentation and assessment;
• Ongoing monitoring frameworks (quarterly, annual, trigger-based);
• Concentration risk assessment;
• Executive-level vendor risk reports.

Core Capabilities

1. Three-Phase Assessment Process

Phase 1: Initial Screening (1-2 days): rapid assessment to determine whether a vendor warrants detailed evaluation.

• Basic information verification (company registration, leadership, business model, customer base);
• Quick risk indicators (recent negative news, public financial data, compliance claims, basic technical architecture);
• Go/no-go decision with initial screening memo.

Phase 2: Detailed Assessment (1-2 weeks): comprehensive evaluation across all risk dimensions. See Section 2.

Phase 3: Final Evaluation (3-5 days): synthesis, risk scoring, mitigation strategies, recommendation.

2. Detailed Assessment Dimensions

Financial Due Diligence

Documents to request: 3 years audited financial statements; commercial credit report; professional liability insurance (€5M minimum); cyber insurance (€5M minimum for IT vendors); banking references.

Analysis: revenue trends and profitability; debt levels and liquidity ratios; customer concentration risk; financial stability score (1-5).

Red flags: consistent losses or negative cash flow; high customer concentration (>30% revenue from one client); recent credit downgrades; inadequate insurance coverage.

Legal and Compliance Due Diligence

Documents to request: articles of incorporation and bylaws; material contracts (top 5 customers and suppliers); pending and historical litigation; regulatory filings; IP portfolio; data protection policies and GDPR documentation; subprocessor list (if data processor).

GDPR compliance review (Art. 28 GDPR): privacy policy and notices; DPA template; breach incident response procedures; international data transfer mechanisms (SCCs, adequacy); Art. 30 records of processing; DPIA process for high-risk processing.

Industry-specific: financial services clients - DORA compliance (Art. 28-30); KRITIS sectors - NIS2 compliance (Art. 21); AI systems - AI Act classification and compliance.

Red flags: pending significant litigation (>10% annual revenue); regulatory enforcement actions; material IP infringement claims; GDPR non-compliance (no DPA, inadequate security).

Security and Technical Due Diligence

Documents to request: security certifications (ISO 27001, SOC 2 Type II, PCI DSS where applicable); recent penetration testing results; security incident history (3 years); business continuity and disaster recovery plans; backup procedures and testing records; technical architecture diagrams; data residency documentation; subprocessor security assessments.

Security assessment: encryption standards (at rest and in transit); access controls and identity management; vulnerability management program; security awareness training; incident response procedures and SLAs; third-party security audits.

NIS2 Art. 21(2) security measures (for KRITIS vendors), mapped to the ten statutory sub-paragraphs:

• (a) Risk analysis and information system security policies;
• (b) Incident handling;
• (c) Business continuity (backup management and disaster recovery) and crisis management;
• (d) Supply chain security, including security-related aspects of relationships with direct suppliers and service providers;
• (e) Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure;
• (f) Policies and procedures to assess the effectiveness of cybersecurity risk-management measures;
• (g) Basic cyber hygiene practices and cybersecurity training;
• (h) Policies and procedures on the use of cryptography and, where appropriate, encryption;
• (i) Human resources security, access control policies, and asset management;
• (j) Multi-factor authentication or continuous authentication, secured voice/video/text communications, and secured emergency communication systems where appropriate.

DORA ICT risk management (for financial services vendors): Art. 6-16 ICT risk management framework; Art. 17-23 incident management; Art. 24-27 digital operational resilience testing; Art. 28-30 third-party risk monitoring.

Red flags: no ISO 27001 or equivalent; no SOC 2 Type II; recent major security incidents with inadequate response; inadequate backup and DR; data residency non-compliance.

Operational Due Diligence

Documents to request: SLA performance history (12 months minimum); customer satisfaction metrics; support structure and escalation procedures; change management and release procedures; service availability statistics; MTTR data.

Analysis: service delivery track record; support responsiveness; technical competency; scalability; exit/transition procedures.

Red flags: consistent SLA failures; poor customer references; inadequate support infrastructure; no documented exit procedures.

3. Six-Dimension Risk Scoring

Score each vendor 1 (Low) to 5 (Critical) across dimensions. Weighted matrix:

Critical services (payment processing, customer data systems, core business operations) receive 2x weight on security and compliance factors.

Risk score interpretation:

• 4.0-5.0: Low Risk; proceed with standard terms.
• 3.0-3.9: Medium Risk; enhanced due diligence required.
• 2.0-2.9: High Risk; additional safeguards needed.
• 1.0-1.9: Critical Risk; consider alternative vendors or reject.

4. DORA Critical Vendor Assessment

For financial services clients, DORA Art. 28-30 impose enhanced requirements for ICT third-party service providers.

DORA Art. 28 - General Principles: comprehensive ICT third-party risk management framework; full contractual documentation of all services; identification of all ICT third-party dependencies; comprehensive exit strategies.

DORA Art. 30 - Mandatory Contract Elements: service description (clear, complete, up-to-date); service locations (including subcontracting); service levels (SLAs with measurement and reporting); GDPR-compliant DPA; minimum security standards; availability and business continuity (DR/BCP); detailed exit strategy; regular and for-cause audit rights; subcontracting prior notification with objection rights; access for authorities (BaFin, ECB, ESMA inspection rights); termination rights (material breach, regulatory concerns); appropriate liability allocation; notice requirements for material changes, incidents, regulatory changes.

Concentration risk (Art. 28(4)): is the vendor used by multiple financial entities? Does this create systemic risk? Are alternatives available? What is our dependency level?

Substitutability (Art. 28(4) read with Art. 29): can we switch vendors within 3-6 months (illustrative planning horizon; DORA itself requires "adequate transition periods" under Art. 30 rather than a fixed window)? Technical lock-ins? Data portability? Contractual barriers to exit?

ICT sub-outsourcing (Art. 30(2)(a), read with the Commission Delegated Regulation on subcontracting RTS, JC 2024 53): all subcontractors identified; subcontractor locations documented; subcontractor security verified; subcontractor change notification process.