Before signing a vendor, establish what it will access or operate, how much your organization depends on it, and what could happen if the supplier or its product were compromised or unavailable. Then investigate the supplier using consistent criteria, verify important claims, and document whether the remaining risk is acceptable. NIST’s SP 1326, finalized in July 2026, provides a practical five-category framework for ICT suppliers; NIST says the due-diligence approach can also be applied to other suppliers.
Start with the decision and the consequences
Vendor due diligence is not just a questionnaire or a check for a recent breach. It is an investigation that supports a specific acquisition decision. NIST defines C-SCRM due diligence as “the investigative process of researching and verifying all available, pertinent information about a given supplier or product so that informed decisions can be made on new acquisitions or existing systems.”
As an Amazon Associate I earn from qualifying purchases.
Before collecting evidence, record what the proposed relationship involves:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors- The service or product and how your organization intends to use it.
- The kinds of data the supplier will handle, store, or be able to access.
- The systems, accounts, networks, or facilities it will connect to or operate.
- How business operations would be affected if the vendor were compromised, disrupted, or no longer available.
- How easily you could replace the supplier or operate without the service.
Use those answers to set the review’s scope and priority. A vendor with privileged access to sensitive systems or an essential operational role deserves more scrutiny than a replaceable supplier with limited access. Establish risk tolerance using your organization’s context; NIST does not prescribe a universal score or threshold.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Identify the supplier and choose the depth of review
Confirm exactly which legal entity and product you are assessing. Capture traceable details such as the company’s legal name, ownership or public-company status, headquarters and operating locations, website, and the identity of the product or service. Check applicable government restriction or exclusion sources before proceeding, based on your organization’s jurisdiction and requirements.
NIST distinguishes basic due diligence—desktop research using publicly available information—from enhanced diligence that may use commercial datasets, proprietary sources, and supply-chain illumination tools. Choose the depth according to the supplier’s criticality and the resources available. For consequential claims, seek corroboration from multiple sources where possible.
Investigate the five core risk areas
NIST SP 1326 organizes ICT supplier research into five categories. Applying the same categories to each candidate makes comparisons more consistent, while your specific service, sector, and risk tolerance determine how much weight each finding receives.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
1. Foreign ownership, control, or influence (FOCI)
Look for ownership, investment, leadership ties, headquarters, applicable foreign laws, or other relationships that could influence company management, operations, or information handling. A foreign connection is not automatically a security finding; assess whether the relationship creates a relevant exposure for your data, service, jurisdiction, and risk tolerance. Define in advance which countries or forms of influence your organization considers material.
2. Provenance
Map where the supplier and its product are developed, assembled, hosted, maintained, and distributed. For hardware, consider components and subcomponents; for software, examine third-party and open-source dependencies. An available software bill of materials (SBOM) can help identify component relationships, but the SBOM itself does not establish that the software is secure, that the inventory is complete, or that listed components have no vulnerabilities.
3. Resilience
Assess whether the supplier can continue meeting its commitments and provide reliable, authentic products. Relevant evidence may include financial distress, leadership turnover, regulatory violations, litigation, data breaches, counterfeits, or product-performance problems. Interpret each finding in context: when it occurred, what was affected, its severity, its effect on confidentiality, integrity, or availability, and what the supplier did to mitigate the problem. An incident is evidence to evaluate, not an automatic reason to reject a supplier.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Foundational cyber practices
Examine both the supplier’s own asset posture and its secure product-development practices. Depending on the service, useful evidence may address exposed credentials, malware or compromises, unnecessary open ports, patching cadence, obsolete software, unpatched product vulnerabilities, end-of-life status, update frequency, and product-specific development practices. Ask for evidence that relates to the particular product or service under consideration rather than relying only on broad company assurances.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
5. Supply-chain tiers
Identify direct suppliers and important dependencies further down the chain. Consider whether the vendor relies on a shared or sole-source provider, whether a sub-tier dependency raises FOCI concerns, and whether relevant exclusion or watch-list exposure exists deeper in the chain. Focus on dependencies that could materially affect the service you are buying; a list of suppliers without an explanation of their role may not show where the practical risk lies.
Judge the evidence, not just the claims
Keep an evidence trail for each material finding. Record the source, date, relevance, completeness, and apparent accuracy of the information. Distinguish independently corroborated facts from supplier statements, and note where evidence is missing or conflicting. NIST SP 800-161 Rev. 1, whose current record includes Update 1 published November 1, 2024, emphasizes documented sources and consistent assessment criteria.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For an incident or vulnerability, establish what happened and what it means for the proposed relationship. Consider recency, affected products or systems, severity, operational impact, and mitigation—not just the existence of a news report or an entry in a database. Check whether the issue applies to the exact product, version, deployment, or supplier entity in scope.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Compare candidates and make a documented decision
Use a common baseline for all candidates, then add factors specific to your environment. These comparison axes synthesize NIST’s categories; they are not a NIST-issued scoring formula:
- Sensitivity of the data and breadth of access required.
- Business or system criticality and ease of substituting the vendor.
- FOCI and geographic exposure relevant to your organization.
- Product provenance and material sub-tier dependencies.
- Supplier resilience and evidence of incident response.
- Vulnerability handling, patching, product lifecycle, and secure-development evidence.
- Evidence quality, unresolved questions, and the consequences of the remaining gaps.
Document the findings, sources, rationale, residual concerns, and decision. Depending on the risk, the outcome may be to proceed, request clarification or remediation, impose conditions, limit access, or not proceed. Translate material concerns into contract requirements—for example, remediation obligations, incident-notification expectations, or monitoring arrangements—rather than leaving them as informal procurement notes.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Reassess risk during the relationship
A pre-contract review is an initial due-diligence step, not a permanent assurance. Ownership, products, dependencies, vulnerabilities, and incidents can change. Set review periods and event-driven triggers in proportion to the supplier’s criticality and contractual exposure, and revisit whether the original assumptions about access, data, and operational dependence still hold.
For the broader risk-management framework, see NIST’s SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, Update 1 record. The guide does not determine legal compliance or settle a vendor-specific assessment; thresholds and required checks depend on your sector, jurisdiction, contract, and systems.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
