What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Assess a vendor by what your business depends on it to do, what it can access, and what the consequences would be if it failed or were compromised—not by how many people it employs. Headcount can help describe a company, but it does not show whether the controls, resilience, or dependencies relevant to your relationship are adequate.
Start with the service, not the supplier’s size
Define the relationship before evaluating the company. Record the service the vendor will provide, the business activity that relies on it, the data it will handle, and the systems or accounts it can access. Then consider what could happen if the service stopped, became unavailable for an extended period, or produced incorrect results.
As an Amazon Associate I earn from qualifying purchases.
This context determines what evidence matters. A vendor with access to sensitive data or systems supporting a critical activity warrants a different level of scrutiny from one providing a low-impact service. NIST describes due diligence as research used to make informed decisions about a supplier or product, including for new acquisitions and existing systems (NIST SP 1326).
Free tools Windows power users keep installed
One-click scans. No signup required.
Scale the review to the consequences
Use a basic review of available public information as an initial screen, then devote more effort to relationships with greater potential impact, sensitivity, or uncertainty. NIST SP 1326 distinguishes basic public-information research from enhanced diligence and describes due diligence as minimum reasonable research (NIST SP 1326).
There is no universal legal checklist established by these sources. Regulatory duties depend on sector, jurisdiction, and the organization’s status. The U.S. Interagency Guidance on Third-Party Relationships applies to banking organizations; its activity-specific approach is a useful principle elsewhere, not a universal legal rule (Interagency Guidance on Third-Party Relationships).
Evaluate evidence relevant to the service
For information and communications technology (ICT) suppliers, NIST SP 1326 provides five areas to examine. Its detailed assessment is ICT-focused, so adapt the underlying principle—review evidence proportionately to the supplier’s activity—when assessing other kinds of vendors.
Foundational cybersecurity practices
Examine evidence about security practices that bear on the service and the access it receives. Ask what the evidence covers, when it was produced, and whether it applies to the product, service, or environment your organization will actually use. A document or certification should not be treated as proof beyond its stated scope.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Resilience and recovery
Consider whether the vendor can continue or restore the activity after a disruption. Review relevant continuity and disaster-recovery arrangements, recovery expectations, and responsibilities. The important question is whether the vendor’s capabilities and commitments match the impact of an interruption to your business.
Rank #3
Ownership, control, influence, and provenance
Where relevant to the service or your obligations, assess foreign ownership, control, or influence (FOCI), as well as the provenance of the product or service. These concerns are context-dependent; the review should establish what is known and whether it changes the risk of this particular relationship.
Subcontractors and supply-chain tiers
Identify whether important functions depend on subcontractors or deeper supply-chain tiers. Determine how much visibility the vendor provides into those dependencies and whether the chain introduces exposures or continuity concerns that matter to the service.
Evidence quality and gaps
For each finding, note its source, date, scope, and relevance. Distinguish verified information from a vendor assertion, and state what remains unknown. If a gap matters, decide whether it can be addressed through additional evidence, a mitigation, contractual terms, or by choosing a different arrangement.
Compare alternatives on the same criteria
When choosing among vendors, use consistent criteria tied to the relationship rather than substituting company size for analysis. NIST’s due-diligence dimensions and the interagency guidance’s activity-specific approach support comparing the following:
Best Value
- Fit for the activity and the consequences of service failure.
- Data sensitivity, system access, and exposure created by the service.
- Relevant security evidence, including its scope and date.
- Resilience, continuity, disaster recovery, and recovery expectations.
- Ownership, control, influence, and provenance concerns where applicable.
- Subcontractors, supply-chain tiers, and visibility into dependencies.
- Contractual responsibilities, available remedies, and unresolved gaps.
Keep the comparison grounded in evidence. A smaller vendor may offer evidence relevant to your needs and a resilient service; a larger one may still be unsuitable for a specific use. These are decision principles, not claims that either size group is generally safer.
Record the decision and revisit it when things change
Document the relationship, evidence reviewed, sources and dates, gaps, planned mitigations, accountable owners, and the decision—including any residual risk the organization accepts. NIST SP 800-161 Rev. 1 includes a supplier assessment record and emphasizes assessment dates, temporal findings, and supplier profile information (NIST SP 800-161 Rev. 1).
Revisit the assessment on a schedule suited to the relationship’s importance and when material facts change. Changes to the service, access, ownership, subcontractors, or evidence may affect the original decision. Treat company size as profile context—NIST’s sample record includes it alongside details such as legal name, domicile, company-family structure, years in business, and market segment—not as a risk score (NIST SP 800-161 Rev. 1).
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
