Vendors
Vendor Assessment Template
The vendor risk assessment template EcoService OS uses to review every new subprocessor before approval.
Vendor Risk Assessment — Template
Use this template for every new sub-processor before production data touches them, and re-run annually.
1. Vendor identity
- Name:
- Website / product:
- Service provided to EcoService Pro:
- Data classes shared: ☐ Public ☐ Internal ☐ Confidential (PII) ☐ Restricted (secrets)
- Data residency:
- Sub-processor list URL:
2. Contract & legal
- ☐ Master Services Agreement / ToS on file
- ☐ Data Processing Agreement (DPA) signed
- ☐ Standard Contractual Clauses (SCCs) if EU/UK data leaves EEA
- ☐ Business Associate Agreement (if PHI — N/A for EcoService Pro today)
- Renewal date:
3. Security posture
- ☐ SOC 2 Type II report reviewed (date: )
- ☐ ISO 27001 certificate reviewed
- ☐ PCI DSS AoC (if payments)
- ☐ Public security page / trust portal URL:
- ☐ Encryption at rest (algorithm):
- ☐ Encryption in transit (TLS version):
- ☐ MFA available and enforced on our tenant
- ☐ Audit log / access log accessible to us
4. Operational
- Uptime SLA:
- Historical uptime (last 12 mo):
- Incident notification SLA:
- Support tier & response time:
- Data export / portability:
5. Data lifecycle
- What we send:
- What we retrieve:
- Retention on vendor side:
- Deletion process on termination:
6. Risk scoring (reuse register: L × I)
| Aspect | L | I | Score |
|---|---|---|---|
| Data exposure | |||
| Availability | |||
| Lock-in | |||
| Compliance | |||
| Overall |
7. Decision
☐ Approved ☐ Approved with compensating control ☐ Rejected
- Compensating controls:
- Reviewer:
- Approver (CEO / Security Lead):
- Approval date:
- Next review date: