How to Run Vendor Security Reviews with AI
Every SaaS subscription is someone else holding your risk. ISO 27001 controls A.5.19 to A.5.23 and PCI DSS 12.8 both demand you assess and monitor suppliers, and nobody has time to read 80-page SOC 2 reports for every vendor.
AI does. Reading long compliance documents and extracting what matters is one of the things it is genuinely best at.
Step by step
- 1
Tier your vendors
Classify by data access and criticality: Tier 1 touches customer or card data, Tier 2 touches internal data, Tier 3 touches nothing sensitive. Review depth follows tier. AI can pre-tier from your vendor list and what each tool does.
- 2
Collect their evidence, not just promises
For Tier 1: SOC 2 report or ISO certificate, recent pen test summary, and their responsibility matrix. For PCI: their Attestation of Compliance. A trust-page screenshot is not evidence.
- 3
Let AI read the reports
Feed the SOC 2 or ISO certificate and report to AI: extract scope, period, exceptions and qualifications, carve-outs, and complementary user controls you are responsible for. The exceptions section is where the truth lives.
- 4
Send the short questionnaire for gaps
Only ask what the documents did not answer. A 60-question blanket form gets template answers; ten targeted questions get real ones.
- 5
Record the decision and the residual risk
Approve, approve with conditions, or reject. Conditions become tasks with owners. The vendor register row links to all the evidence.
- 6
Re-review on cadence and on triggers
Annual for Tier 1, two-yearly for Tier 2, and immediately on breach news, ownership change, or scope change. AI monitors expiry dates and drafts the renewal requests.
Where AI helps
- Report analysis: AI extracts exceptions, carve-outs, and your obligations from SOC 2 and ISO reports in minutes.
- Pre-tiering: AI classifies the vendor list by data access for human confirmation.
- Questionnaire drafting: AI writes targeted follow-up questions from the document gaps.
- Renewal tracking: AI watches certificate and report expiry dates and drafts the chase emails.
Tips
- ›Read the complementary user entity controls in every SOC 2: that is the list of things YOU must do for their controls to work.
- ›A vendor that will not share any audit report for a Tier 1 role is itself a finding.
Skills and templates
Copy-paste these into your AI assistant (as a custom skill, project instruction, or system prompt) or your repo. Replace the [bracketed] placeholders with your details.
Vendor review skill
Paste a SOC 2 report or ISO certificate plus the vendor context; get the structured review and a recommendation.
vendor-security-review.SKILL.md--- name: vendor-security-review description: Analyses vendor security evidence (SOC 2, ISO 27001 certs, AOCs) and produces a structured review with a recommendation. Human makes the final approval decision. --- You are the vendor security reviewer for [Company]. Given a vendor name, what we use them for, what data they touch, and their evidence documents: 1. Tier the vendor (1 = customer or card data, 2 = internal data, 3 = no sensitive data) with one line of reasoning. 2. From the documents extract: framework and scope, audit period and report date, auditor, opinion, every exception or qualification, carve-outs, and complementary user entity controls that apply to us. 3. List unanswered questions a targeted questionnaire should ask (max 10). 4. Output a recommendation: approve, approve with conditions (list them as tasks), or escalate. Mark it [HUMAN DECISION REQUIRED]. 5. Produce the vendor register row: vendor, tier, services, data, evidence reviewed, expiry or next review date, decision, owner. Rules: - Evidence older than 15 months is stale; say so. - Scope mismatch (report covers a different product than we use) overrides a clean opinion. - Never approve autonomously.
Targeted vendor questionnaire
Ten questions that get real answers. Send only what their documents did not already cover.
vendor-questionnaire.md# Vendor security questionnaire, [Vendor], [date] 1. Where is our data stored and processed (regions), and can it be pinned to [region]? 2. Is our data encrypted at rest and in transit, and who holds the keys? 3. Which of your staff can access our data, and what authentication protects that access? 4. What is your breach notification commitment in hours, and to whom do you notify? 5. Which subprocessors touch our data? Link your current list. 6. What were the exceptions in your most recent SOC 2 / ISO audit, and their remediation status? 7. What is your data retention and deletion process on contract termination, with timeframe? 8. When was your last penetration test, and can you share the executive summary? 9. Do you support SSO/SAML and SCIM for our tenancy, on our current plan? 10. What uptime SLA applies to us, and what was your actual availability over the last 12 months?
Run this with Vanta
The market-leading compliance automation platform.
FAQ
- Is a SOC 2 report enough to approve a vendor?
- Usually for Tier 2, often for Tier 1 if the scope covers the service you use and the exceptions are minor. Check scope, period, and exceptions; an unqualified opinion on the wrong scope proves nothing.
- What does PCI DSS require for vendors?
- Requirement 12.8: keep a TPSP list, written agreements with responsibility acknowledgments, due diligence before engagement, annual compliance monitoring, and a responsibility matrix.