Vendor due diligence requirements are based on which factors?

• A. Regulatory requirements; corporate IT security and data privacy requirements; applicable industry standards; best practices
• B. Vendor location
• C. Vendor size
• D. Customer demand

Answer: (A)

Vendor due diligence is guided by the risks and compliance requirements tied to the data and services a vendor will handle. The most important factors to assess are regulatory requirements that apply to the vendor’s operations (jurisdictional data protection laws, industry-specific rules, etc.), your own corporate IT security and data privacy requirements (the baseline controls your organization expects for protecting information), and applicable industry standards and best practices that establish proven controls and benchmarks (for example, ISO 27001, NIST frameworks, SOC 2, PCI-DSS where relevant).

Why this set matters: regulatory requirements ensure you’re addressing legal obligations and any mandatory security or reporting duties. Your internal IT security and privacy requirements ensure there’s a consistent, defensible standard you can enforce across vendors. Standards and best practices provide objective criteria to evaluate whether a vendor’s security posture and data handling align with recognized, reputable benchmarks. Together, they help ensure the vendor can protect data, meet contractual obligations, and participate in your risk management program.

Why location, size, or customer demand aren’t the basis for these due diligence requirements: location or size don’t inherently determine a vendor’s security controls or legal obligations, and customer demand doesn’t establish the necessary risk controls or compliance criteria you must verify.