Vendor diligence, from documents to open questions

Begin with the proposed use.

Consider a fictional business evaluating a new hosted service. The packet contains a service agreement, data-processing terms and a brief statement about security. The business wants to proceed, but counsel needs to understand what those materials establish.

The intended data, users and business dependency shape the review. A low-risk internal trial and a service holding sensitive customer records call for different questions. Do not assume the more demanding use is covered merely because the agreement permits access to the software.

Read the documents together.

Look for where the commercial agreement and data-processing terms address the same subject. A general liability provision may interact with a more specific promise elsewhere. A short security statement may omit the retention period, subprocessor arrangement or evidence needed for the client’s decision.

Distinguish three kinds of statement.

A vendor may say a control exists. A contract may require the vendor to maintain it. A supplied report may provide evidence about a defined scope and period. Those are different forms of support. Do not convert one into another.

Make the open questions usable.

Ask for the particular missing information and explain why it matters to the proposed use. Separate an unanswered factual question from a negotiating position. Prioritize what must be resolved before the decision and what can reasonably follow later.

Finish with a decision brief, not a pile of text.

Summarize the supported facts, material gaps and choices for the business. Review the sources and proposed wording before using the result. The fictional example is not a certification of a vendor or a substitute for a security assessment.