vendor-security-assessment
Drafts a Vendor Security Assessment Questionnaire evaluating third-party cybersecurity posture, data handling, and regulatory compliance. Vendor responses become binding contractual representations with executive certification. Use during vendor due diligence, third-party risk management, procurement security review, or subprocessor evaluation.
Best use case
vendor-security-assessment is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Drafts a Vendor Security Assessment Questionnaire evaluating third-party cybersecurity posture, data handling, and regulatory compliance. Vendor responses become binding contractual representations with executive certification. Use during vendor due diligence, third-party risk management, procurement security review, or subprocessor evaluation.
Teams using vendor-security-assessment should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/vendor-security-assessment/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How vendor-security-assessment Compares
| Feature / Agent | vendor-security-assessment | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Drafts a Vendor Security Assessment Questionnaire evaluating third-party cybersecurity posture, data handling, and regulatory compliance. Vendor responses become binding contractual representations with executive certification. Use during vendor due diligence, third-party risk management, procurement security review, or subprocessor evaluation.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Vendor Security Assessment Questionnaire Generates a pre-contract due-diligence questionnaire for evaluating vendor security controls, data practices, and compliance across GDPR, CCPA, HIPAA, SOX, GLBA, FERPA, and industry frameworks. ## Quick Start Gather before drafting: 1. **Vendor scope** — data types accessed (PII, PHI, PCI, financial, proprietary), processing activities, data flows 2. **Applicable regulations** — GDPR, CCPA, HIPAA, SOX, GLBA, FERPA, or sector-specific 3. **Risk tolerance** — what constitutes acceptable vs. disqualifying vendor risk 4. **Contract alignment** — security provisions to incorporate by reference ## Document Framework | Element | Requirement | |---|---| | Preamble | Completion mandatory pre-contract; responses are binding representations | | Executive certification | Senior officer (CISO/CTO/CLO) attests accuracy; signature block required | | Submission deadline | 10–15 business days | | Change notification | Vendor notifies within 5 business days of material security changes | | Confidentiality | Questionnaire and responses treated as confidential business information | ## Assessment Domains Draft numbered questions per domain. Each question includes a response field and evidence-request field where applicable. Tailor scope to data sensitivity — not every vendor needs every domain. **1. Information Security Governance** - Dedicated CISO/equivalent; certifications (CISSP, CISM, CISA) - Framework alignment (NIST CSF, ISO 27001, CIS Controls, COBIT) - Policy review cadence; security awareness training (all-staff + specialized) - Board-level security reporting frequency **2. Data Classification & Lifecycle** - Classification taxonomy compatibility with client's scheme - All data storage/processing locations (primary, DR, backup, cloud regions) - Cross-border transfer mechanisms (SCCs, adequacy decisions, BCRs) - Retention post-termination; destruction methods; certificates of destruction - Backup frequency; encrypted backup media; tested RTO/RPO **3. Access Control & Privileged Access** - MFA enforcement across all access; supported factors - RBAC, least-privilege, segregation of duties - Privileged access: JIT elevation, session recording, auto-deprovisioning - Access recertification frequency; anomalous-access alerting **4. Vulnerability Management & Testing** - Scanning tools, frequency, and patching SLAs: | Severity | Patch SLA | |---|---| | Critical | ≤ 24–72 hrs | | High | ≤ 7 days | | Medium | ≤ 30 days | | Low | ≤ 90 days | - Annual third-party pentests (external + internal lateral movement) - AppSec testing (SAST, DAST, SCA) for custom software - Bug bounty / responsible disclosure program - Request most recent pentest summary and remediation status **5. Incident Response & Business Continuity** - Documented IR plan with roles, escalation, communication protocols - IR testing frequency (tabletop, simulations) and recent results - Notification timeline — must allow client to meet most restrictive regulatory deadline (GDPR 72 hrs, HIPAA 60 days, state breach laws) - Cooperation with client IR team and legal counsel - Cyber insurance: policy limits, third-party liability, adequacy for data volume - BCP/DR: tested RTO/RPO, geographic diversity, multi-scenario resilience **6. Encryption & Key Management** - At rest: minimum AES-256; scope includes production, dev/test, backups, portable media - Database encryption approach (TDE, column-level, application-layer) - In transit: TLS versions, deprecated protocol status, enforced cipher suites - In use: confidential computing / secure enclave capabilities (if applicable) - Key management: HSM/KMS storage, rotation frequency, secure destruction **7. Network Security & Segmentation** - Customer isolation; production vs. corporate separation - Zero-trust architecture status - Perimeter controls: firewalls, IDS/IPS, WAF, DDoS protection - Remote access: VPN, NAC/device posture, MFA - Assessment cadence (external scans, internal pentests, wireless) **8. Subprocessor Risk Management** - Complete subprocessor inventory: role, data access, location, assessments conducted - Flow-down of security requirements (contractually at least as stringent as client's) - Client notification and approval rights before new subprocessor engagement - Right to terminate non-compliant subprocessors **9. Certifications & Compliance** - SOC 2 Type II: report date, principles, opinion status, scope alignment - ISO 27001: certificate dates, scope, certification body - PCI DSS, FedRAMP/StateRAMP, HITRUST, TISAX (as applicable) - Regulatory compliance confirmation for applicable data types - Commitment to provide updated reports/certifications annually **10. Physical Security & Environmental Controls** - Data center access: MFA, visitor logs, surveillance, security personnel - Background checks for personnel with physical access - Environmental: fire suppression, UPS, generators, climate, water detection - Facility certifications (SSAE 18 SOC 1, Uptime Institute tier) **11. HR Security & Insider Threat** - Background checks; periodic re-investigation for sensitive roles - Security training before access; policy acknowledgment - Offboarding: access revocation timeline, exit procedures - Insider threat monitoring; DLP for exfiltration prevention ## Risk Assessment Framework Score vendor responses after receipt: | Rating | Criteria | |---|---| | Low | Controls meet/exceed requirements; evidence provided | | Moderate | Minor gaps; addressable via contractual provisions | | High | Significant gaps; requires remediation plan with deadlines | | Critical | Fundamental deficiencies; disqualifying absent remediation | Assessment report must include: - Per-domain and overall risk rating with justification - Recommended contractual controls (audit rights, insurance minimums, SLAs) - Evidence gaps requiring follow-up - Go/no-go recommendation with conditions - Flagged inconsistencies between responses and publicly available information ## Checks - State explicitly in preamble: responses are **contractually binding representations**; incomplete/misleading answers constitute grounds for disqualification or material breach - Align notification timelines with the **most restrictive applicable breach notification law** - Mark questions as required vs. conditional based on data type (PCI questions only if payment data involved) - Flag vendors refusing to disclose subprocessors or share certifications as elevated risk - All legal citations to specific regulatory provisions must be verified against current law [VERIFY]
Related Skills
managing-wound-assessment-nursing
Structures wound assessment with measurement, staging, and treatment plan documentation. Use when assessing wounds, staging pressure injuries, or documenting wound care.
managing-trauma-assessments
Conducts structured primary and secondary trauma surveys following ATLS methodology. Use when assessing trauma patients, documenting trauma workups, or coordinating trauma team activations.
managing-speech-therapy-assessments
Structures speech-language evaluation with articulation, language, swallowing, and cognitive-communication assessment. Use when conducting speech evaluations, assessing swallowing function, or documenting communication disorders.
managing-range-of-motion-assessments
Documents goniometric measurements with active/passive ROM and comparison to normative values. Use when measuring joint ROM, documenting mobility assessments, or tracking ROM progress.
managing-psychological-trauma-assessments
Guides trauma-informed assessment with PTSD screening and trauma history documentation. Use when assessing trauma exposure, screening for PTSD, or documenting trauma history.
managing-periodontal-assessments
Structures periodontal evaluation with probing depths, attachment levels, and disease classification. Use when conducting periodontal assessments, classifying gum disease, or documenting periodontal status.
managing-pain-assessment-nursing
Applies pain assessment scales (NRS, Wong-Baker, FLACC, BPS) with intervention documentation and reassessment. Use when assessing pain, selecting pain scales, or documenting pain management.
managing-orthodontic-assessments
Structures orthodontic evaluation with classification, treatment options, and progress documentation. Use when evaluating orthodontic needs, classifying malocclusion, or documenting treatment progress.
managing-occupational-therapy-assessments
Structures OT evaluation with ADL assessment, adaptive equipment needs, and work readiness evaluation. Use when conducting OT assessments, evaluating ADL independence, or recommending adaptive equipment.
managing-newborn-assessments
Structures newborn examination with Apgar scoring, gestational age assessment, and initial screening. Use when examining newborns, documenting birth assessments, or performing initial newborn evaluations.
managing-geriatric-assessments
Conducts comprehensive geriatric assessment covering cognition, function, falls, polypharmacy, and goals. Use when evaluating elderly patients, performing geriatric assessments, or managing complex older adults.
managing-environmental-health-assessments
Structures environmental health evaluations with exposure assessment and risk communication. Use when assessing environmental health risks, evaluating contamination, or communicating environmental findings.