Customer & Vendor Security Reviews
Customer and vendor security reviews, handled by people who answer them
Before a large customer signs, they assess you. It might be an enterprise security questionnaire, a bank's or payment partner's due diligence package, an insurer's vendor review, a prime contractor's supplier requirements, or a health plan's supplier security terms. We take the review off your plate and get it to approved, with answers you can stand behind.
What reviewers usually ask for
- An independent audit report, often SOC 2 Type 2, and sometimes HITRUST, ISO 27001, or PCI DSS evidence
- A recognized security framework behind the program
- Penetration testing and vulnerability management evidence
- Encryption, MFA, access reviews, and logging
- Incident response and breach notification commitments
- Oversight of your own vendors and subprocessors
- Increasingly, how you use and govern AI
Reviews by industry
Enterprise and SaaS customers: standard and custom questionnaires, trust packages, and security calls with buyers. Technology and SaaS
Banks and payment partners: vendor due diligence packages, often alongside PCI DSS questions. Fintech
Insurers: vendor and partner security reviews. Insurance
Prime contractors and large manufacturers: supplier security requirements, including NIST SP 800-171 for CUI. Manufacturing
Health plans and health systems: supplier security terms, BAAs, and SOC 2 or HITRUST requests. Healthcare
How we handle a review
Triage: we read the questionnaire and contract clauses and flag what's a must-have versus negotiable.
Answer: accurate, defensible answers with evidence attached. No overclaiming.
Close gaps: where an answer is 'not yet', a remediation plan with dates the buyer can accept, including SOC 2 or HITRUST readiness when required.
Defend: we join the buyer's security call and handle follow-ups.
Reuse: an answer library and trust package so the next review takes far less effort.
Experience on both sides of the table
Our practitioners have answered reviews for fintech, technology, and healthcare companies, including digital-health vendors whose customers included national health plans and a large national insurer. Case studies
Related: SOC 2 readiness · Fractional CISO · Product security · Industries