Which step is essential in a security due diligence process for vendors?

• A. Negotiate price first
• B. Monitor compliance after onboarding
• C. Vet vendors for security practices
• D. Ignore security clauses

Answer: (C)

Evaluating vendor security practices before onboarding is essential. This step lets you understand how a vendor protects data, what controls are in place to prevent unauthorized access, how incidents are detected and managed, and how data is handled throughout the relationship. By vetting security up front, you can assess overall risk, set clear expectations, and require specific safeguards in the contract or through formal assurances. This often involves reviewing security questionnaires, certifications (like ISO 27001 or SOC 2), evidence of vulnerability management, encryption standards, access controls, and incident response procedures. It also gives you the leverage to require remediation, adjust the scope of access, or even decline engagement if the vendor cannot meet your security requirements.

Negotiating price first doesn’t address security risk, and monitoring compliance after onboarding, while important, is a later step that verifies what was agreed but doesn’t prevent initial risk. Ignoring security clauses is unsafe and undermines protections, whereas proper vetting builds a solid security foundation for the relationship.