Vendor Risk Management Required Attestation

Vendor Security Baseline Questionnaire

Required for all third-party vendors handling client data, accessing internal networks, or integrating into client systems. Evaluated against minimum baseline safeguards.

Choose Assessment Track:

The Golden Rule of Vendor Security: If you don’t know whether something is set up, it probably isn’t. Security controls like full-disk encryption, immutable 3rd-party cloud backups, and monitored EDR require deliberate implementation, configuration, and licensing. Please don't guess—if you aren't sure, check with whoever manages your IT or select the unmanaged/partial option.

Section 1

Company & Contact Information

Vendor / Organization Name *

Website / Domain

Primary IT / Security Contact Name *

Title / Role

Primary IT Contact Email *

Phone Number

Date Completed *

Section 2

Core Security Controls

Please check all statements that apply to your organization.

Attestation Tip: If you don't know whether a control is set up or enforced, it probably isn't. Only check statements you have verified.

1 Multi-Factor Authentication (MFA)

MFA required for ALL remote access (VPN, RDP, cloud services) MFA required for all email accounts MFA required for all administrative accounts Not implemented / Partial implementation

How to tell if you have enforced MFA

Enforced: Users MUST approve an authenticator app prompt or hardware key on every login.
Not enforced: MFA is optional for users, only prompted once months ago, or SMS text only.

2 Endpoint Protection

Managed antivirus / EDR on all devices

Centrally monitored by IT team or Managed Service Provider (MSP) Automatic updates enabled Full-disk encryption (e.g., BitLocker / FileVault) on all workstations None of the above

EDR vs. Consumer Antivirus & Encryption Reality Check

EDR/MDR: Centrally monitored enterprise agents (SentinelOne, Defender for Business, CrowdStrike, Huntress). Retail consumer AV (Norton, McAfee, unmanaged free Defender) is NOT managed EDR.

Disk Encryption: BitLocker or FileVault scrambling the physical drive. A standard Windows/Mac user login PIN/password is NOT disk encryption.

3 Email Security

Advanced email filtering / security solution

Phishing and malware scanning enabled Email encryption available for sensitive data Spam filtering only / No additional security

Advanced Email vs. Basic Spam Filtering

Dedicated AI filtering (Avanan, Defender Plan 1, Inky, Proofpoint) and SPF/DKIM/DMARC domain authentication. The built-in "Junk" folder on free or basic email is basic spam filtering only.

4 Patch Management

Automated patch deployment for OS and applications Monthly or more frequent patching cycle Critical patches deployed within 7 days Ad-hoc patching only

5 Access Control

Password policy enforced (minimum 12+ characters, complexity) Least-privilege access model is followed Regular user access reviews conducted (quarterly or better) Administrative accounts are separated from standard user accounts Minimal or no access controls

6 Backup & Recovery

Daily automated backups Backups stored offsite or in a separate cloud account (air-gapped) Backup restoration successfully tested within the last 6 months Documented recovery procedures are in place No formal backup process

7 Incident Response

Documented incident response plan Security monitoring is in place

Clear breach notification process Cyber liability insurance

None of the above

8 Security Operations & Procedures

Documented security policies (updated annually) Staff security awareness training

Change management procedures for IT systems Vulnerability scanning is performed

Minimal or no formal procedures

Section 3

Quick Risk Assessment

Management oversight, sensitive data exposure, and security track record.

Who manages your IT security? *

Internal dedicated IT team Managed Service Provider (MSP)

Part-time / contractor Owner / staff as needed

Do you handle sensitive data?

Please check all types of sensitive data handled.

Tax returns / Financial records Healthcare / HIPAA data Payment card data (PCI) Social Security Numbers / PII (Personally Identifiable Information) None of the above

Have you experienced a security incident in the last 2 years? *

No Yes

Brief description of incident & remediation:

Compliance / Certifications

Please check all that apply.

SOC 2 Type II ISO 27001 IRS Publication 4557 compliant HIPAA compliant None / Not applicable

The Sexy 8 Baseline

Operational Security Controls

Foundational cybersecurity safeguards required for all business partners, referral partners, and non-technical vendors.

Honest Attestation: If you don't know whether something is set up or enforced, it almost certainly isn't. When in doubt, select “Partial” or “No”, or verify with your IT team before certifying.

1 Multi-Factor Authentication (MFA / 2FA) *

Is MFA strictly enforced across all work email accounts (M365, Google Workspace) and remote/cloud logins?

Yes — Enforced on all work email accounts, cloud services, and remote access Partial — Enabled on some systems or optional for certain users No — Passwords only / MFA not enforced

How to tell if you actually have this (Avoid false positives)

✅ You have this if: Every employee is prompted for a mobile authenticator app push/code (Microsoft Authenticator, Duo, Google Authenticator) or hardware security key when logging into email and cloud software.

❌ Common Trap — You DO NOT have this if: MFA is optional for users, only turned on for the company owner, or you only received a one-time SMS text code months ago when setting up your device.

2 Device Full-Disk Encryption *

Are all company laptops and workstations protected with full-disk encryption (BitLocker on Windows, FileVault on Mac)?

Yes — Full-disk encryption enforced on all company computers Partial — Enabled on some computers only No — Full-disk encryption not implemented

How to tell if you actually have this (Avoid false positives)

✅ You have this if: BitLocker (Windows Pro/Enterprise) or FileVault (macOS) is explicitly turned on. If the physical laptop is lost or stolen, the hard drive cannot be read by anyone without the cryptographic recovery key.

❌ Common Trap — You DO NOT have this if: You only have a Windows PIN or user login password. A user login password is NOT disk encryption; an attacker who steals the laptop can remove the drive, plug it into another computer, and read all client files immediately.

3 Dedicated Cloud-Integrated Backups *

How are your business emails, cloud repositories (SharePoint/OneDrive/Google Drive), and business data backed up?

Dedicated 3rd-Party Cloud Backup — Automated backup service independent of primary cloud (e.g., Dropsuite, Datto, Veeam, Acronis, NinjaOne Backup) Default Cloud Sync Only — Relying solely on default Microsoft 365 or Google Drive recycle bin/trash Local External Hard Drives — Manual or external drive backups No Formal Backups

How to tell if you actually have this (Avoid false positives)

✅ You have this if: You pay for an independent backup service (Dropsuite, Datto SaaS Protection, Veeam, Acronis, NinjaOne) that continuously takes immutable copies of your mailboxes, SharePoint, and Google Drive to a separate cloud vault.

❌ Common Trap — You DO NOT have this if: You rely on OneDrive, Google Drive, or Dropbox folder sync. Folder sync is NOT a backup. If ransomware encrypts your files or a rogue hacker deletes your cloud tenant, sync instantly replicates the destruction and the default trash is permanently emptied after 30 days.

4 Next-Gen Defense (EDR / MDR Endpoint Protection) *

What endpoint protection is centrally managed across all company computers?

Managed EDR / MDR — Centrally monitored Next-Gen protection (e.g., SentinelOne, Defender for Business, CrowdStrike, Sophos, Huntress) Standard Consumer Antivirus — Unmanaged or standalone consumer software (e.g., Norton, McAfee, free Windows Defender) No Centralized Endpoint Security

How to tell if you actually have this (Avoid false positives)

✅ You have this if: You have an enterprise EDR/MDR platform (like SentinelOne, Microsoft Defender for Business via M365 Business Premium, CrowdStrike Falcon, Huntress, or Sophos Intercept X) deployed and actively monitored by an IT team or 24/7 Security Operations Center (SOC).

❌ Common Trap — You DO NOT have this if: You use retail consumer antivirus (Norton, McAfee, Avast, Webroot, or unmanaged free Windows Defender without a centralized cloud portal). If it was purchased from Best Buy or preinstalled on a store-bought PC, it is NOT managed EDR/MDR.

5 Email Security & Anti-Phishing

Check all email protections and domain safeguards active for your business domain:

Advanced anti-phishing, safe link scanning, and malware filtering active Email domain authentication configured (SPF, DKIM, and DMARC records active) Email encryption available for sensitive messages and client documents Default basic spam filter only (no dedicated anti-phishing or DLP solution)

How to tell if you actually have this (Avoid false positives)

✅ You have this if: You have dedicated cloud email security (Avanan, M365 Defender Plan 1, Inky, Proofpoint) that dynamically rewrites malicious links and quarantines weaponized attachments, AND your DNS domain has published SPF, DKIM, and DMARC authentication records to prevent spoofing.

❌ Common Trap — You DO NOT have this if: You rely solely on the default "Junk" folder that comes built into basic email accounts (like GoDaddy webmail or personal Gmail/Yahoo).

6 Automated Patch Management & Updates *

How are operating system (Windows/macOS) and application security patches applied?

Automated Deployment — Patches deployed automatically (weekly or within 14 days of release) Monthly Cycle — Scheduled monthly patching cycle across all systems Ad-Hoc / Manual — Updates applied irregularly when prompted; frequently delayed >30 days

How to tell if you actually have this (Avoid false positives)

✅ You have this if: An automated management agent (like an IT RMM tool or Microsoft Intune) automatically installs and reboots for Windows, macOS, and third-party software updates (Chrome, Zoom, Adobe) on a strict schedule without relying on employees.

❌ Common Trap — You DO NOT have this if: Employees click "Remind me tomorrow" on update pop-ups, or computers go weeks without rebooting or receiving critical security patches.

7 Incident Response Readiness & Cyber Insurance *

Documented Incident Response Plan — Written runbook for responding to ransomware, account takeovers, or data breaches

Do you maintain active Cyber Liability Insurance? *

Yes — Active cyber liability insurance policy No — No dedicated cyber insurance

How to tell if you actually have this (Avoid false positives)

✅ You have this if: You have a written step-by-step incident response plan (who to call, legal notification triggers, forensic containment) AND a dedicated commercial Cyber Liability Insurance policy with a stated limit ($1M+).

❌ Common Trap — You DO NOT have this if: Your plan is "we'll call someone if we get hacked", or you assume your general business liability policy covers cyber (standard business insurance almost never covers ransomware payments, forensic investigation, or data breach liability without a dedicated cyber policy).

8 Independent IT & Security Oversight (The “No-DIY” Rule) *

Who actively manages, monitors, and verifies your organization's IT security posture?

Managed Service Provider (MSP / MSSP) — Professional outsourced IT & security provider

Dedicated Internal IT Staff — Full-time internal IT / security team Professional IT Consultant / Contractor DIY / Owner or Office Staff as Needed (No dedicated IT oversight)

How to tell if you actually have this (Avoid false positives)

✅ You have this if: You have demonstrable, active oversight from qualified internal IT/security staff, an MSP/MSSP, or an independent consultant with defined accountability to monitor, patch, and secure your systems. (A business can use any qualified provider).

❌ Common Trap — Paying for tech is not managing tech: ChatGPT is not your CTO; GoDaddy is not your IT department. Subscribing to Microsoft 365, antivirus, or cloud storage does not mean anyone reviews alerts, tests backups, or responds to warnings. The office manager or owner troubleshooting ad-hoc is DIY IT. Software is a tool; accountability is a responsibility.

Client Data Management

Data Storage, Devices & History

How your business securely stores, segregates, and transmits client files and sensitive records.

9. Client Data Storage & Transmission Safeguards

Check all statements that describe how client files, records, and communications are handled:

Stored exclusively in authenticated corporate cloud repository (e.g., Company SharePoint, Google Workspace for Business) Sensitive documents transferred via encrypted portals or encrypted email only Least-privilege access enforced: staff only access client records required for their specific role Files stored locally on individual desktop computers, personal laptops, or portable USB flash drives

How to tell if you actually have this (Avoid false positives)

✅ You have this if: Client documentation is strictly housed in an authenticated business cloud repository (SharePoint, Google Workspace) with access controls, and transmitted via password-protected or encrypted links.

❌ Common Trap — You DO NOT have this if: Staff routinely save client tax returns, accounting files, or medical records directly onto their local desktop, unencrypted USB thumb drives, or unmanaged personal computers.

10. Device Access & BYOD (Bring Your Own Device) Policy *

Are personal, unmanaged smartphones or home computers permitted to access or store client records?

No / Managed Only — Client data is restricted strictly to company-owned, IT-managed workstations Yes (Enforced MDM & MFA) — Personal devices permitted only if registered in Mobile Device Management with enforced MFA Yes (Unrestricted BYOD) — Staff use personal laptops, tablets, or phones without centralized management

How to tell if you actually have this (Avoid false positives)

✅ You have this if: Staff are prohibited from accessing client data on unmanaged personal hardware, OR personal phones/laptops are enrolled in an MDM platform (like Microsoft Intune) that enforces PINs, encryption, and remote wipe capabilities.

❌ Common Trap — You DO NOT have this if: Employees or contractors freely access or download client files on their personal home computers (often shared with family or kids) without corporate management software.

11. Types of Sensitive Client Data Handled

Check all categories of sensitive or regulated client data your organization handles or stores:

Tax returns, banking details, financial statements, or accounting records Protected Health Information (PHI) / HIPAA healthcare records Payment cardholder information (PCI / credit cards) Social Security Numbers, driver's licenses, or government identification (PII) General business confidential / client proprietary operational files only None of the above (No client confidential data or PII handled)

12. Have you experienced a security incident, ransomware attack, or email compromise in the last 2 years? *

No — No breaches or security incidents in the last 2 years Yes — Incident experienced

Brief description of incident, impact, and remediation:

Section 4

Signature & Attestation

Formal certification of provided answers.

“I certify that the information provided above is accurate to the best of my knowledge.”

I acknowledge and certify the accuracy of these statements, and agree that submitting my name electronically constitutes a legal signature. *

Electronic Signature (Full Name) *

Print Title *

Date Attested *

Questionnaire Submitted Successfully

Your attestation has been encrypted and transmitted directly to the Tech Concierge review team.

Reference ID: VSQ-XXXXXX

Vendor:

Baseline Assessment:

Confirmation Sent To: