Vendorapp › OpenVMO › Due diligence
Due diligence in OpenVMO.
Due diligence is how you find out whether a vendor is fit to hold what you are giving it. Everyone gets baseline checks; Tier 1 and 2 vendors get security and privacy checks that reuse assurance the vendor already has wherever possible.
Open standard, CC BY 4.0 · Free, no sign-up · Works with a spreadsheet · Maps to SOC 2, ISO 27001, NIS2, DORA
Why it matters
What this domain is for.
Customers and auditors want to see that you looked before you trusted. They do not expect a bespoke questionnaire for every tool, and sending one to a vendor with a current SOC 2 report wastes both sides’ time.
Due diligence is one of the 11 domains of the OpenVMO framework, an open standard for running vendor management at a startup. Each practice below has a minimum maturity level: you only need the practices at or below the level you are aiming for.
Practices
The 5 DD practices.
Baseline checks
Every vendor gets baseline checks: legal entity, website domain, and a sanctions or denied-party check where your jurisdiction requires one. Evidence: The date and result of the baseline checks for each vendor.
Security diligence by tier
Tier 1 vendors provide assurance reports (SOC 2 Type II, an ISO 27001 certificate verified with the issuer, or a penetration test summary) or answer a standard questionnaire. Tier 2 vendors get a trust-centre or certificate check. Tier 3 needs nothing beyond baseline. Evidence: The assurance documents or questionnaire responses, stored against the vendor with the review date.
Privacy diligence
Any vendor processing personal data has a data processing agreement, a lawful transfer mechanism and a subprocessor list on file. Evidence: The DPA, the transfer mechanism and the subprocessor list for each such vendor.
Findings recorded
Findings and accepted risks are recorded with an owner and an expiry date. Evidence: A risk log entry for each finding: owner, decision and expiry.
Optional modules
Where relevant, extra checks cover financial viability, ESG, the vendor’s use of AI and model providers, and concentration. AI checks apply from Level 2 when vendors process customer data with AI. Evidence: Results of the optional checks you have adopted, with the reason they apply.
A practice counts as in place only when a dated record shows it was performed. A tool that could perform it does not count on its own.
By stage
What good looks like at each level.
| Level | What good looks like |
|---|---|
| Level 1: Foundational | Baseline checks (entity, domain, sanctions where required) on every vendor. |
| Level 2: Managed | Tier-proportionate security and privacy diligence, evidence stored, findings logged with owners. |
| Level 3: Defined | Optional modules adopted where they matter: financial health, ESG, AI use, concentration. |
| Level 4: Optimised | Diligence results feed continuous monitoring and are benchmarked across the vendor base. |
With a spreadsheet
Doing it without any special tool.
- Use the OpenVMO due-diligence matrix: it lists what to accept for each tier, best first.
- Store each vendor’s evidence in one folder per vendor and link it from the register.
- Accept existing assurance before sending a questionnaire: SOC 2 Type II, verified ISO 27001, CSA STAR, Cyber Essentials Plus, or an MVSP self-attestation.
Common mistakes
Where teams usually go wrong.
- Accepting an ISO 27001 certificate without checking it with the certification body.
- Sending a 300-question spreadsheet to a Tier 3 vendor.
- Finding an issue and recording nothing about who accepted the risk or until when.
Crosswalk
How this maps to the frameworks you are audited against.
| Framework | Related requirements |
|---|---|
| SOC 2 (Trust Services Criteria) | CC9.2, CC3.2 |
| ISO/IEC 27001:2022 | A.5.19, A.5.21, A.5.23 |
| NIS2 and Implementing Regulation 2024/2690 | Art. 21(3) |
| DORA | Art. 28(4), Art. 28(5) |
| NIST CSF 2.0 | GV.SC-06 |
The mapping is informative, not legal advice: it points to where each framework deals with the same topic. The full mapping for every practice is on the crosswalk page.
Templates
Templates for this domain.
- Due-diligence matrix (Markdown): What evidence to accept for each tier, in order of preference, so you only send questionnaires when you have to.
All OpenVMO templates are on the templates page.
Previous domain: Risk tiering. Next domain: Contracts.
Run OpenVMO with a spreadsheet, or with a tool.
Every practice can be met with the free templates. If you would rather not maintain the register by hand, Vendorapp implements most of OpenVMO and has a free plan.