# OpenVMO due-diligence matrix

OpenVMO v1.0 · Licence: CC BY 4.0 · https://vendorapp.co/openvmo/due-diligence/

What to check for each tier (practices DD-1 to DD-3), and what evidence to accept, **best first**. Use existing assurance before sending a questionnaire.

## Checks by tier

| Check | Tier 1 | Tier 2 | Tier 3 |
| --- | --- | --- | --- |
| Legal entity and website domain confirmed | Yes | Yes | Yes |
| Sanctions or denied-party check (where your jurisdiction requires it) | Yes | Yes | Yes |
| Security assurance reviewed | Yes: report or questionnaire | Trust centre or certificate | No |
| Privacy: DPA, transfer mechanism, subprocessor list | If personal data | If personal data | If personal data |
| Findings logged with owner and expiry (DD-4) | Yes | Yes | If any |
| Optional modules: financial health, ESG, AI use, concentration (DD-5) | Where relevant | Where relevant | No |

## Evidence to accept, in order of preference

1. **An independent assurance report.** A SOC 2 Type II report (with a bridge letter if the period ended more than a few months ago), or an ISO 27001 certificate **verified with the certification body** and with a scope that covers the service you use.
2. **Recognised schemes.** CSA STAR Level 1 or 2, Cyber Essentials Plus, or a Minimum Viable Secure Product (MVSP) self-attestation.
3. **The vendor's trust centre.** Published policies, certifications and subprocessor lists.
4. **A standard questionnaire.** A short, widely used one (for example a "core" or "lite" version) rather than your own.
5. **A bespoke questionnaire.** Only for Tier 1 vendors where nothing above exists, and only the questions the gaps require.

## Recording the result

For each vendor, store the evidence in its folder and record in the register: the assurance type, issuer, reference, expiry and the date you verified it. Log any finding you accept as a risk with an owner and an expiry date.