The Mechanism That Blocks Enterprise Contracts
Vendor Risk Assessment is the process through which an Enterprise organization evaluates a potential supplier’s security before signing a contract — or regularly verifies existing vendors. For companies subject to DORA, NIS2 or SOC 2, this is a regulatory obligation, not a choice.
The questionnaire arrives from the client’s security team. 40, 80, sometimes 200+ questions. Tight response deadline. Every answer verified against evidence.
The problem: most tech companies don’t have ready documentation. They scramble — pulling the CTO, senior engineers and lawyers into a multi-week effort to compile responses. The result is often inconsistent and incomplete.
How to Respond Effectively
Principle 1: Admit gaps honestly. “We haven’t implemented this yet, planning for Q2 with this approach” is better than “Yes, we have it” without evidence. An analyst who discovers a discrepancy escalates. An analyst who sees an honest answer with a plan usually accepts with a follow-up condition.
Principle 2: Provide evidence, not declarations. “We use OIDC for pipeline-to-cloud authorization” + configuration link > “We use secure cloud access management.” Specifics beat generalities. An Evidence Pack exists precisely for this.
Principle 3: Map responses to standards. If you have CI/CD hardening mapped to DORA, SOC 2 or ISO 27001 — reference specific controls and articles.
Top 10 VRA Questions and What’s Behind Them
- “Do you use encryption in transit and at rest?” — Baseline. TLS 1.3, HSTS, database encryption.
- “How do you manage access to production systems?” — MFA, least-privilege, access reviews, offboarding.
- “Do you have a formal change management process?” — Code review, branch protection, separation of duties, audit trail.
- “How do you manage secrets and credentials?” — Red flag: static API keys. Green flag: OIDC, Vault, automatic rotation.
- “Do you generate SBOM?” — Increasingly common. CycloneDX SBOM with every build stands out.
- “How do you monitor dependency vulnerabilities?” — Automated SCA scanning, critical CVE remediation SLA.
- “Do you have an incident response plan?” — Documented process, response time, escalation path, test history.
- “How do you ensure deployed code integrity?” — Artifact signing, provenance verification, SLSA compliance.
- “Do you conduct penetration tests?” — Frequency (min 1x/year), scope, finding remediation.
- “Do you hold SOC 2 / ISO 27001 certification?” — The fastest shortcut. A certificate closes dozens of questions at once.
Without certification, an Evidence Pack is the next strongest evidence you can present.