Procurement teams often assess vendor security with a questionnaire the vendor has answered a hundred times. These questions work better.
- Who on your team can access our production data, and how is that logged?
- What happens to our data when the contract ends?
- When did you last have an independent penetration test, and can we see the executive summary?
- How do you patch, and what is your target window for a critical vulnerability?
- Have you had a breach? What changed afterwards?
- Where is our data stored, physically?
- How do you handle secrets in your build pipeline?
- What is your recovery time objective, and when did you last test it?
- Who do we call at 2am?
Why these work
None of them can be answered with a certification. All of them are answerable in one sentence by a vendor who has thought about it, and produce visible discomfort in one who has not.