// supplier-security-check
Supplier Security Check
Before you sign with a supplier, we check whether they can be trusted with your data. You get the answer on one page.
What you get
- Security questionnaire, tailored to the supplier and your data
- Evidence review: certificates, reports, contracts and policies the supplier shares
- Risk rating
- One-page decision memo: sign, sign with conditions, or don't sign
He checks how your suppliers really work, not what their brochure says.
When a cloud provider, software vendor or service partner gets access to your data, their weak spot becomes yours. In third-party risk management, Chan Vu audited suppliers for large enterprises across the whole security picture:
- Policies and governance: do written security rules exist, are they current, and does anyone follow them?
- Security management: is there a working ISMS with risk management, responsibilities, internal audits and real follow-up on findings?
- Identity and access management: who can access what, how rights are granted and removed, and how admin access is controlled.
- Data protection: technical and organisational measures (TOMs) under the GDPR, data processing agreements, where data is stored and who processes it.
- Technical security: cloud and hosting setup, encryption, logging and monitoring, patching and vulnerability handling.
- Evidence, not promises: certificates and attestations (ISO 27001, TISAX, BSI C5) checked for scope and validity, plus documents, interviews and samples where a certificate does not cover the risk.
The result is always a clear decision: sign, sign with conditions, or do not sign.
How it runs
You tell us who the supplier is, what they will do and which data they will see.
We send the questionnaire and request evidence from the supplier.
Evidence review and risk rating.
You get the one-page decision memo and a short call to walk through it.
Good fit / not a fit
A good fit if
- You are about to sign with a hosting provider, an AI vendor or an agency.
- Your own customers ask how you check your suppliers.
- You want a clear decision, not a 40-page report.
Not a fit if
- You need a legal review of the contract. That stays with your lawyer.
- You want a stamp of approval, whatever the evidence shows.
- You cannot tell us which data the supplier will handle.
Pricing
FROM €3,900 PER SUPPLIER
The final price depends on the supplier's size, the service and systems in scope, and the framework you need: BSI IT-Grundschutz, ISO 27001 or TISAX. The timeline depends on how fast the supplier answers. Several suppliers at once are quoted together. All services are for business customers only. Prices net, plus VAT. Fixed quote after the intro call.
Questions
What does the decision memo say?
One of three answers: sign, sign with conditions, or don't sign. With the reasons, the risk rating, and the conditions to put into the contract.
What if the supplier does not answer?
Then that is part of the answer. We rate what we can see and say clearly what is missing.
What do you check against?
The framework you need: BSI IT-Grundschutz, ISO 27001 or TISAX. For cloud suppliers we also read their BSI C5 report where one exists. The questions are scaled to the data the supplier will handle.
Who does the check?
Chan Vu Luu, who spent years deciding whether suppliers could be trusted with sensitive data, as a consultant and as Deputy Information Security Officer.
Often paired with
AI Assistant Integration
A customer-facing AI assistant on your site: scoped, guardrailed, checked for data flows, and deployed.
Security Readiness Review
About 5 days of gap analysis against ISO 27001, TISAX or your customers' questionnaires, with a prioritised roadmap. Readiness, not certification.
Have something to ship?
FREE INTRO CALL · FIXED QUOTE WITHIN 2 WORKING DAYS OF THE CALL
Start a project