IT Vendor Risks: How to Verify Those You Trust with Your Data

Vendor risks have become a central focus because external contractors often have broader permissions than internal employees. The NIS2 directive explicitly addresses this, and audits are increasingly scrutinizing this specific area.

TL;DR — Key Takeaways

• Inventory all vendors with access to systems or data.
• Categorize them by criticality and adjust requirements accordingly.
• Ensure access is time-limited, identity-based, and secured with MFA.
• Contracts must include a mandatory incident notification clause.

What IT Vendor Risk Management Means

It is a systematic review of which external partners can access your data or systems, what the impact would be in case of their downtime or a breach, and how to mitigate that risk. The result is a vendor register with risk assessments and required security measures.

For critical vendors (IT support, ERP providers, hosting), additional requirements are necessary: proof of security practices, a business continuity plan, a dedicated incident contact point, and regular access reviews.

Why This Is Becoming Critical

Attackers increasingly enter through a partner rather than attacking directly.

• One breached provider gives access to dozens of their clients simultaneously.
• Third-party access often remains active long after a project ends.
• NIS2 requires supply chain security management.
• In the event of a vendor incident, the responsibility toward your customers remains yours.

How to Start — Recommended Process

1. Create a vendor register describing access levels and processed data.
2. Assign a criticality level and required security measures to each vendor.
3. Implement named user access with MFA and time limits instead of shared accounts.
4. Include security clauses and incident notification deadlines in contracts.
5. Review active access permissions annually and remove unnecessary ones.
6. Define an alternative solution for critical vendors in case of failure.

Requirements Based on Vendor Criticality

Common Mistakes

The most common mistake is providing permanent shared accounts for external contractors. During an incident, it is impossible to determine who accessed the system, and these doors often stay open for years.

Another mistake is relying on questionnaires without verification. For critical vendors at least, demand evidence of security practices, not just statements.

How VitalIT Can Help

VitalIT helps you establish a vendor register, manage access controls, and prepare contractual security clauses. Explore our IT Consulting and Cybersecurity services.

Related: NIS2 Directive and How to Choose an IT Partner.

Frequently Asked Questions (FAQ)

How often should we review access permissions?

Quarterly for critical vendors, otherwise once a year.

Do we need a Data Processing Agreement (DPA) with everyone?

With anyone who processes personal data on your behalf — even if the access is only technical.

What if a vendor refuses security requirements?

This is a risk indicator in itself; for critical services, it is a reason to seek an alternative provider.

How do we verify a smaller provider?

Use a short questionnaire regarding backups, MFA, access controls, and incident procedures, and check their references.

Is a vendor's ISO 27001 certificate sufficient?

It is a good sign, but check the scope of the certificate — it often only covers a specific part of the organization.