Run Vendor Security Assessment and SOC 2 Collection — Free

Inspection Scope and Vendor Profile

Vendor legal name and service description confirmed

Record the vendor's legal entity name and a concise description of the service being provided.

Review type identified

Select whether this is a pre-onboarding assessment, annual review, or other re-assessment.

Vendor will access company data or systems critical (required)

Confirm whether the vendor will store, process, transmit, or access company data or systems.

Yes No N/A

Data classification and system scope documented

Identify the data types and systems in scope for the review.

Security Attestations and Certificates

Current SOC 2 report provided critical (required)

Confirm that a current SOC 2 Type I or Type II report has been provided for review.

Yes No N/A

Photo evidence (optional)

SOC 2 report type and period covered recorded

Record the SOC 2 report type and the coverage period.

ISO certificate provided if applicable

Confirm whether an ISO certificate, such as ISO 27001, was provided when claimed or required.

Yes No N/A

Photo evidence (optional)

Certificate or report is current and unexpired critical (required)

Verify that the SOC 2 report, ISO certificate, or equivalent assurance document is current and within its validity period.

Yes No N/A

Bridge letter or remediation note provided for report gaps

If the assurance report period is not current, confirm whether a bridge letter or equivalent explanation has been provided.

Yes No N/A

Security Governance and Access Controls

Security program owner identified

Confirm that the vendor has a designated security owner or equivalent accountable role.

Yes No N/A

Access control and least privilege practices documented critical (required)

Confirm that the vendor maintains role-based access control and least privilege for systems handling customer data.

Yes No N/A

Multi-factor authentication enforced for administrative access critical (required)

Verify that MFA is enforced for administrative, privileged, and remote access where applicable.

Yes No N/A

Encryption in transit and at rest confirmed critical (required)

Confirm that customer data is encrypted in transit and at rest using industry-standard controls.

Yes No N/A

Vulnerability management and patching cadence documented

Confirm that the vendor has a documented vulnerability scanning and patch management process.

Yes No N/A

Incident Response, Business Continuity, and Privacy

Incident response plan available critical (required)

Confirm that the vendor maintains a documented incident response plan.

Yes No N/A

Security incident notification timeframe documented

Record the contractual or policy-based timeframe for notifying customers of a security incident.

Business continuity or disaster recovery plan available critical (required)

Confirm that the vendor maintains a business continuity or disaster recovery plan and tests it periodically.

Yes No N/A

Privacy and data retention practices documented

Confirm that data retention, deletion, and privacy obligations are documented and aligned to the service scope.

Yes No N/A

Subprocessor or fourth-party oversight addressed

Confirm whether the vendor uses subprocessors and whether oversight, approval, or disclosure is documented.

Yes No N/A

Findings, Exceptions, and Approval

Open deficiencies documented

List any deficiencies, non-conformances, or exceptions identified during the review.

Corrective action plan required for material gaps

Confirm whether a corrective action plan is required for any material security gap or missing evidence.

Yes No N/A

Risk acceptance or exception approved

Confirm whether any residual risk or exception has been formally approved by the appropriate authority.

Yes No N/A

Inspector signature critical (required)

Inspector or reviewer signature confirming the assessment was completed.

Get your results

Enter your email — we'll send you a PDF of your filled-out template, plus the occasional MangoScoop newsletter (templates, workflow tips, product updates). Unsubscribe anytime — link is in every email.

Email (required)

Your name (optional)

Run: Vendor Security Assessment and SOC 2 Collection

Inspection Scope and Vendor Profile

Security Attestations and Certificates

Security Governance and Access Controls

Incident Response, Business Continuity, and Privacy

Findings, Exceptions, and Approval

Get your results