Which document verifies a supplier's compliance posture during vendor management?

Which document verifies a supplier's compliance posture during vendor management?

• A. Statement asserting compliance with no evidence
• B. Insurance certificate only
• C. Signed agreements that specify security, training, and documentation requirements
• D. Employee performance reviews

Answer: (C)

Verifying a supplier’s compliance posture relies on a signed agreement that clearly spells out security, training, and documentation requirements. This contract creates binding obligations and provides a concrete basis for assessment. By specifying what controls must be in place (like access controls, data handling, incident response), what training must be completed, and what documentation must be maintained (policies, procedures, audit reports), it sets measurable criteria that the supplier must meet. It also enables you to request evidence, conduct audits, and verify that the supplier is actually following through on those requirements. Relying on a statement that the supplier is compliant without evidence offers no verifiable proof. An insurance certificate shows insurance coverage, not the supplier’s security or regulatory posture. Employee performance reviews assess internal staff performance and don’t address the supplier’s adherence to security or governance controls.

Verifying a supplier’s compliance posture relies on a signed agreement that clearly spells out security, training, and documentation requirements. This contract creates binding obligations and provides a concrete basis for assessment. By specifying what controls must be in place (like access controls, data handling, incident response), what training must be completed, and what documentation must be maintained (policies, procedures, audit reports), it sets measurable criteria that the supplier must meet. It also enables you to request evidence, conduct audits, and verify that the supplier is actually following through on those requirements.

Relying on a statement that the supplier is compliant without evidence offers no verifiable proof. An insurance certificate shows insurance coverage, not the supplier’s security or regulatory posture. Employee performance reviews assess internal staff performance and don’t address the supplier’s adherence to security or governance controls.