# Supplier due diligence How to tier, check, contract and re-review suppliers that touch your data or product, under ISO 27001, ISO 9001, ISO 13485, UK GDPR, SOC 2 and DORA. Source: https://sted.digital/docs/guides/supplier-due-diligence · Last reviewed 17 October 2026 · Strand Guides List suppliers, tier them by how critical they are and what data they touch, and collect evidence in proportion: a SOC 2 report, an ISO certificate with its scope, or a short questionnaire. Read that evidence for scope and exceptions, put security and data protection terms in the contract, record the approval, and re-review each critical supplier at least yearly. ## When you need this ISO 27001:2022 Annex A 5.19 to 5.22 expect you to manage the security risk of suppliers, set it in agreements, cover the ICT supply chain and monitor changes; 5.23 adds cloud services. ISO 9001:2015 8.4.1 asks for criteria to evaluate, select, monitor and re-evaluate external providers, with 8.4.2 and 8.4.3 on the controls and the information you give them. ISO 13485:2016 7.4.1 makes the criteria proportionate to the supplier's effect on the device. UK GDPR Article 28(1) allows only processors that can show they will protect the data properly, and SOC 2 CC9.2 expects vendor risk to be assessed and managed. EU DORA Article 28 and Article 30 set ICT third-party rules for financial entities. The trigger is any new supplier, renewal or change of service. Operations or procurement usually runs it, with IT and the privacy lead. This is guidance to help you understand the requirement, not legal advice. ## Before you start You need a list of current suppliers from finance (every recurring payment is a candidate), the system owners who know what each supplier touches, and your contract templates, including a data processing agreement. Agree the tiering criteria with whoever approves suppliers. A low-risk supplier takes under an hour. A critical supplier with a SOC 2 report to read and a contract to negotiate takes two to five days of effort over a few weeks. ## Steps 1. Inventory every supplier, with the service, the owner and the data or systems it touches. Done when the list matches the payments ledger. 2. Tier each supplier as critical, important or low, by its effect on your service, product or customers and by its access to personal or confidential data. Done when each supplier has a tier and a reason. 3. Collect evidence in proportion to the tier: a SOC 2 report, an ISO certificate with its scope, a questionnaire, insurance cover, a financial check. Done when the evidence pack for the tier is complete. 4. Review the evidence. Read the scope, the period, the exceptions and the controls the supplier expects you to run. Done when each finding is written down with a decision to accept, mitigate or reject. 5. Contract with a security schedule, confidentiality terms, the processor terms of UK GDPR Article 28(3), notice of sub-processor changes, incident notice times, audit rights, a transfer mechanism for any data leaving the UK, and return and deletion at exit. Done when the signed contract holds each term. 6. Approve the supplier and record the decision, the approver, the date and any conditions. Done when the approval record is complete. 7. Monitor the supplier: re-review critical suppliers at least yearly, and act on incident notices, certificate expiry and sub-processor changes. Done when the next review date is set. 8. Exit in a planned way: retrieve or delete data, revoke access and record the disqualification or end of service. Done when access is removed and deletion is confirmed in writing. ## Reading a SOC 2 report or ISO certificate Logos prove nothing. The document behind them does, once you read the right parts. ### A SOC 2 report Check five things. The **type and period**: a Type II covering the last 12 months shows controls working over time; a Type I shows design at one date only. The **opinion**: an unqualified opinion is the norm; a qualified one names criteria that were not met. The **exceptions** in the test results: each is a control that failed in testing, so read management's response. The **subservice organisations**: under a carve-out, the hosting provider's controls are outside the report, so you need its report too. The **complementary user entity controls**: what the supplier assumes you do, such as managing your own users. Any of them you do not do is your gap. ### An ISO certificate Check the scope statement names the service and the sites that deliver it, the expiry date, and that the certification body is accredited (in the UK, by UKAS). A certificate for "head office administration" says nothing about the data centre. ## Worked examples ### ISO 27001, a payroll service for a 25-person firm A 25-person agency chooses a payroll SaaS that will hold salaries, bank details and National Insurance numbers. It is tiered critical. The supplier sends an ISO 27001 certificate and a SOC 2 Type II report for 1 January to 31 December 2025, with an unqualified opinion. Review finds two things. The report shows one exception: the Q3 access review was not performed, and management describes the fix. The complementary user entity controls require customers to enforce multi-factor authentication for their payroll administrators, which the agency had not switched on. It accepts the first with a request for the 2026 report, and enables multi-factor authentication before go-live (Annex A 5.19 and 5.22). The contract adds a security schedule, 24-hour incident notice, 30 days' notice of sub-processor changes, and data return as CSV within 30 days of exit, then deletion (5.20). The finance director approves on 14 May 2026 with one condition, the multi-factor authentication check, and the review is set for May 2027. ### UK GDPR, the same supplier as a processor The payroll SaaS is a [processor](/docs/glossary/controller-and-processor). The agency checks its data processing agreement against UK GDPR Article 28(3) and finds no term on helping with rights requests; the supplier adds one. The agreement gives general authorisation for sub-processors with notice and a right to object (UK GDPR Article 28(2)), and flows the same terms down (UK GDPR Article 28(4)). The sub-processor list shows hosting in AWS London and a support desk in South Africa with remote access to payroll data. That is an [international transfer](/docs/glossary/international-transfer) to a country without UK adequacy, so the agency confirms an International Data Transfer Agreement is in place and records the supplier's transfer risk assessment before approval. ### ISO 9001, the same tiers for quality suppliers ISO 9001:2015 8.4.1 follows the same tiers, with evaluation criteria based on the supplier's effect on product quality and delivery. ### ISO 13485, a sterilisation contractor ISO 13485:2016 7.4.1 applies the same steps with criteria proportionate to device risk, so a sterilisation contractor gets an on-site audit where a stationery supplier gets none. ### SOC 2, subservice organisations SOC 2 CC9.2 is tested by sampling your supplier reviews; the payroll review above, with its exception and user-control decisions, is the evidence. ### DORA, an ICT provider supporting a critical function A payments firm records the payroll and hosting arrangements in its register of information under EU DORA Article 28 and checks the contract against the key provisions of EU DORA Article 30. ## Checklist - [ ] The supplier list matches the payments ledger. - [ ] Every supplier has a tier and a reason. - [ ] Evidence for each critical supplier is current. - [ ] SOC 2 exceptions and user entity controls were read and acted on. - [ ] ISO certificate scope covers the service bought. - [ ] Processor contracts hold every Article 28(3) term. - [ ] Sub-processors and transfers are known and covered. - [ ] Each approval names the approver, the date and any conditions. - [ ] Critical suppliers were re-reviewed in the last 12 months. - [ ] Exited suppliers confirmed deletion in writing. ## How Sted helps Under the Supplier Approval and Management Procedure (PRC-SAMP) Sted's knowledge base holds three record templates, the Supplier Approval Record (REC-SAR), the Supplier Review Record (REC-SRR), which comes with a suggested annual frequency, and the Supplier Disqualification Record (REC-SDQ), each tagged to ISO 27001 supplier controls, ISO 9001 8.4, ISO 13485 7.4 and SOC 2 CC9.2. Records are part of the Full Management System plan. Sted's knowledge base includes a Supplier Approval Record (REC-SAR) under the Supplier Approval and Management Procedure (PRC-SAMP), which records the supplier's criticality, the information security and data protection review, and whether its data processing agreement is signed and holds the required processor terms. Records are part of the Full Management System plan. Sted's knowledge base includes a Cloud System Record (REC-CSR) under the Cloud Computing Policy (POL-CLD), which records the regions a cloud service uses and, for each transfer of personal data outside the UK or the European Economic Area, the mechanism relied on, the signed instrument and the transfer impact assessment behind it. Records are part of the Full Management System plan. 33 periodic record types come with a suggested frequency, but nothing is scheduled until you pick a first due date. Records take file attachments, scanned for malware before download. Records follow templates with sections and, where useful, structured fields you can report on. Records are part of the Full Management System plan. Sted does not assess, audit or approve your suppliers. You review the evidence and decide; Sted keeps the record. ## Related standards - [ISO 27001 organisational controls](/docs/standards/iso-27001/annex-a-organisational-controls): controls 5.19 to 5.23 in context. - [Processors and data processing agreements](/docs/standards/gdpr/processors-and-contracts): every Article 28 term in full. - [International transfers](/docs/standards/gdpr/international-transfers): the transfer check in step 5. - [Working with your SOC 2 auditor](/docs/standards/soc-2/working-with-your-auditor): carve-outs and user entity controls from the other side. - [SOC 2 report](/docs/glossary/soc-2-report) and [certification body](/docs/glossary/certification-body): the two documents you will read most. - [Where your data lives](/docs/product/where-your-data-lives): the same questions, answered for Sted itself. ## Frequently asked questions Q: What should a supplier security questionnaire ask? A: Ask only what changes your decision: certifications and their scope, the latest SOC 2 report, where data is hosted, sub-processors, encryption, access control, backups, incident notice times and what happens to your data at exit. A supplier with a current SOC 2 Type II report or an ISO 27001 certificate covering the service can usually skip most of a long questionnaire. Q: Is an ISO 27001 certificate enough to approve a supplier? A: No, not on its own. Check that the certificate's scope covers the service you are buying and the sites that run it, that it is current, and that it was issued by an accredited certification body. You still need the contract terms and, for processors, the UK GDPR Article 28(3) clauses. Q: How often should suppliers be re-reviewed? A: At least once a year for critical suppliers, and every two or three years for low-risk ones. Review sooner after an incident, a change of ownership, a new sub-processor or a lapsed certificate. ISO 9001:2015 8.4.1 asks for criteria for re-evaluation, so write the frequency into your procedure.