A questionnaire alone does not explain why a relationship was approved. This template captures the context and judgment behind a third-party decision without implying that one record replaces legal, procurement, or security review.
Relationship context
Record the service, business owner, criticality, data and system access, geography, concentration, substitutability, and contractual dependency.
Diligence summary
Distinguish verified facts from vendor statements and reviewer assumptions.
- Evidence reviewed and its coverage period
- Material safeguards and dependencies
- Open findings and compensating measures
- Contractual security conditions
- Changes that trigger reassessment
Decision and follow-through
Record approve, conditional approve, remediate before use, accept, or decline; then name the approver, conditions, owners, deadlines, and next review date.
Related resources
Original educational material. Adapt it to your environment and obtain qualified legal, audit, privacy, or security advice where appropriate.