What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Before approving a new supplier, identify who you are contracting with, map the service’s access and business importance, and review evidence in proportion to the risks. Record the decision, its conditions, and how the relationship will be monitored. This checklist is a practical baseline—not a substitute for jurisdiction-specific legal, privacy, tax, insurance, sanctions, or regulated-sector review.
How to vet a new vendor
Start with the supplier’s role and exposure, then set the review depth. A vendor that receives sensitive data, can access business systems, or supports a hard-to-replace process warrants more scrutiny than a low-impact supplier with no access. NIST puts the timing plainly: “Acquirers who make procurement decisions need to be informed about potential supplier risks before those decisions are executed.”
As an Amazon Associate I earn from qualifying purchases.
NIST SP 1326, finalized July 8, 2026, provides a current due-diligence structure for ICT suppliers. It is specifically scoped to ICT; the general practice of reviewing suppliers applies more broadly. Its definition is: “Due diligence research is the investigative process of researching all available, pertinent information about a given supplier or product so that informed decisions can be made on new acquisitions or existing systems.”
Recommended Free Tools
Supplier onboarding checklist
-
Identify the supplier and accountable owners
Record the supplier’s legal entity name, the service or product being purchased, your business sponsor, and procurement contact. Note the supplier’s place in the supply chain. For higher-risk relationships, establish relevant ownership or control, subsidiaries, and sub-tier providers. NIST SP 1326 includes traceable company information and foreign ownership, control, or influence (FOCI) in ICT supplier due diligence.
#1 Best Overall
321Done Weekly Checklist Notepad, 5.5x8.5 Inches, 50 Sheets, Undated- Desk pad layout: Plan your week at a glance with this 5.5 x 8.5 inches size notepad, designed for daily task management, weekly to-do, and errand tracking right on your desk or bag
- Undated, Monday-Sunday format: 50 tear-off sheets with no date printed, so you can start any week and use the pad anytime - seven-day layout supports appointment tracking and weekly productivity planning
- Versatile planning tool: Use as a weekly schedule, priority list, meal planning pad, grocery list, or task tracker - flexible enough for home, office, and student use
- 70 lb heavyweight paper: Thick sheets provide a clean writing surface - ink does not bleed through, so you can write with any pen, marker, or highlighter without affecting the page below
- Made in USA: designed, printed, and hand assembled in the USA - thank you for supporting small businesses like ours; a compact half letter desk pad built for reliable weekly planning
-
Classify the relationship and exposure
Describe the business process that depends on the supplier, how readily it could be replaced, and whether the supplier or its subcontractors will have physical or logical access to facilities, systems, software, or data. CISA’s small-business vendor supply-chain risk management (SCRM) material distinguishes use cases including physical or logical access, cloud-hosted solutions, and managed service providers.
-
Set review depth before sending questions
Choose the evidence and approval level based on criticality, access, data handling, substitutability, and operational dependency. Do not send every low-risk vendor the same exhaustive assessment. NIST SP 1326 addresses ICT suppliers; CISA’s template is designed to help small and medium-sized businesses adapt questions to a supplier use case.
Rank #2
-
Check identity, eligibility, and context
Validate that the entity you intend to contract with is the entity being reviewed. Screening requirements depend on the jurisdiction, transaction, and buyer. For U.S. government procurement contexts, NIST identifies the ITA Consolidated Screening List and SAM entity exclusions as possible pre-check resources; these are not a universal checklist for private-sector buyers, and some sources may have access restrictions.
Free tools Windows power users keep installed
One-click scans. No signup required.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Assess evidence that matches the exposure
For ICT suppliers, organize review around the five NIST SP 1326 domains:
Rank #3
- Foreign ownership, control, or influence.
- Provenance.
- Resilience.
- Foundational cybersecurity practices.
- Supply-chain tiers.
Request evidence relevant to the service, note partial or unclear responses, and follow up on material gaps. A completed questionnaire or certification alone does not prove that a supplier is safe. CISA’s SMB spreadsheet supports yes, no, or partial responses with explanations.
-
Review privacy and data handling
Establish what data the supplier will receive or generate, what it may do with that data, whether and how it may share or sell it, how long it retains it, and how deletion works when the relationship ends. The FTC advises businesses to address vendor data use, sharing, sale, retention, and deletion. Have privacy or legal staff review the specific terms that apply to your data and jurisdiction.
-
Put relevant expectations in the agreement
Write security requirements clearly, including any standards the supplier must follow, and define how your organization will verify compliance. Depending on the relationship, address incident notification and cooperation, remediation, subcontractor flow-downs, and return or deletion of data at exit. FTC guidance supports written security provisions and verification; NIST software supply-chain guidance discusses attestation and flow-down obligations for sub-tier suppliers. Exact contractual terms depend on context and should be reviewed by counsel.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Record the approval decision
Keep the risk tier, questionnaire, supporting evidence, open findings, mitigations, decision owner, approval date, and any conditions together in one record. CISA’s template is a free starting point for tracking ICT vendor questionnaire responses. If high-impact gaps remain, possible outcomes include mitigation, restricted scope, a documented exception, or not proceeding; select an outcome based on business risk and applicable obligations.
-
Plan monitoring after onboarding
Set a review interval and event triggers that reflect the supplier’s risk. Triggers may include a material service change, breach, ownership change, significant subcontractor change, or deterioration in evidence. FTC advises verifying compliance and updating vendor requirements as threats change.
Choose review depth by risk, not by a universal score
NIST and CISA do not provide a universal numeric supplier-risk score or fixed weights. Use the following dimensions to decide what evidence and approval are proportionate:
| Review dimension | Questions to resolve |
|---|---|
| Service criticality | Which process depends on the supplier, and what would be disrupted if the service were unavailable? |
| Access and data | Will the supplier or its subcontractors reach facilities, systems, software, or sensitive data? |
| Substitutability and resilience | How difficult is it to replace the supplier, and what continuity evidence is relevant? |
| Ownership and provenance | For ICT suppliers, what is known about ownership/control, product or service provenance, and relevant supply-chain tiers? |
| Evidence quality | Are responses supported by evidence, or are important answers partial, unclear, or unverified? |
| Mitigation burden | Can gaps be addressed with controls, contractual terms, restricted scope, or monitoring, and who owns those actions? |
For a small-business starting point, CISA provides vendor SCRM material and an Excel spreadsheet that supports yes/no/partial answers with explanations. CISA’s template page is dated October 26, 2021; check the page for the available downloadable file and use it as an adaptable aid rather than proof of compliance. CISA’s 2023 fact sheet described “More than 30 million small and medium-sized businesses (SMBs) across the United States” and “nearly half of the nation’s gross domestic product.” Those are dated context figures, not current-year estimates.
Keep the review scoped to the applicable rules
Supplier onboarding may involve legal, privacy, tax, insurance, sanctions, procurement, and sector-specific obligations that vary by location and transaction. The ICT-focused NIST framework is not a substitute for those reviews. U.S. government screening resources should be used where applicable, not treated as mandatory checks for every buyer. Route contract language and any uncertain legal requirement to the appropriate internal specialists.
Or skip the browser setup
If your onboarding workflow includes capturing supplier webpages as evidence, ScreenshotNeo offers a one-request screenshot API. For example, capture a page as WebP with cURL:
Quick Recap
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo API documentation for options. ScreenshotNeo can accept cookie or consent banners as a visitor and remove more than 60 known consent platforms, newsletter popups, and chat widgets before capture; each step can be turned off. Bot checks, blank pages, timeouts, failed loads, and cache hits are not billed, and response headers identify the page verdict and billing status. Its MCP server provides screenshot and PDF tools for AI agents. The free plan includes 1,000 screenshots a month with no card; paid plans start at $5 for 3,000. See ScreenshotNeo for product details. Sign up free for 1,000 screenshots a month, with no card required.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
