Which standards require a vendor security assessment procedure?

ISO/IEC 27001:2022: 5.19, 5.22; DORA (Regulation (EU) 2022/2554): Art. 28.

What must a vendor security assessment procedure contain under ISO 27001?

5.19: Define and apply processes to manage the security risk suppliers introduce. 5.22: Regularly monitor, review and manage change in supplier security practice and service delivery. The ISO 27002 guidance beside 5.19: Requires processes and procedures to be defined and implemented for managing the information security risks that arise from using suppliers' products or services.

Who should own the vendor security assessment procedure?

The clauses imply procurement or the vendor manager, with the information security lead. The register names the role so the line on your list can carry a name.

How often should a vendor security assessment procedure be reviewed?

Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).

Is there a template for a vendor security assessment procedure?

Yes: https://compliance.theartofservice.com/policy-templates/vendor-security-assessment-policy

Every policy type · Suppliers and third parties

Vendor security assessment procedure

How a supplier is assessed before contract and on a cycle after it: the questionnaire, the evidence asked for, the scoring and who signs it off.

How the register reads it

Also called	supplier due diligence, vendor questionnaire
Family	Suppliers and third parties
Document type	Procedure. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Folds into	The regimes accept it folded into the supplier and third-party security policy; when neither is listed, the gap is counted once, under the parent.
Expected owner	Procurement or the vendor manager, with the information security lead.
Review cadence	Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list when	never on its own: the register recognises it and names the clauses, but no ticked regime lists it as a separate document (its parent, supplier and third-party security policy, is).
Template	Vendor security assessment policy.

Which standards require it, and what each expects it to contain

3 requiring clauses, 2 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 5.19 Information security in supplier relationships

Define and apply processes to manage the security risk suppliers introduce.

What the ISO 27002 guidance expects the document to say: Requires processes and procedures to be defined and implemented for managing the information security risks that arise from using suppliers' products or services.

Evidence an auditor accepts: The supplier security process, covering identification, risk assessment, selection, onboarding and exit; the supplier register with risk tiering, showing what drives the tier such as data access, criticality or connectivity; risk assessments performed for suppliers in the period, at the depth their tier requires
Common gap: Treating all suppliers as low risk
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO 27001 5.22 Monitoring, review and change management of supplier services

Regularly monitor, review and manage change in supplier security practice and service delivery.

What the ISO 27002 guidance expects the document to say: Requires supplier information security practice and service delivery to be monitored, reviewed and evaluated on a regular basis, and requires change within them to be managed.

Evidence an auditor accepts: The schedule of supplier reviews, showing frequency by tier and evidence the schedule was met; service reports and security metrics received from suppliers, and the review of them; records of issues raised with suppliers, and their resolution or escalation
Common gap: relying on informal verbal updates
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

DORA (Regulation (EU) 2022/2554)

DORA Art. 28 ICT third-party risk: general principles

Financial entities shall manage ICT third-party risk as an integral component of ICT risk, maintain a Register of Information on all contractual arrangements for the use of ICT services, report it to competent authorities, assess risk before entering arrangements (including concentration and subcontracting), and adopt an ICT third-party risk strategy.

Evidence an auditor accepts: A Register of Information of ICT third-party arrangements reported to the competent authority; pre-contract risk assessment records
Common gap: No Register of Information
Source: DORA (Regulation (EU) 2022/2554)

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Vendor contract security requirements · Business continuity plan