· By Nicholas “Nick” O'Sullivan, Townsville
Vendor assurance: better questions before you trust another platform
A software demonstration shows what a product can do. It rarely answers what happens when the vendor has a security incident, its sign-in system fails or your organisation needs to leave. Those questions belong in the buying decision too.
Recent discussion within MITIE has included work towards a national vendor assurance questionnaire, bringing school ICT leaders and EdTech CEOs together around privacy, cyber security and operational risk. A common set of questions could reduce repeated paperwork and make answers easier to compare. It is an initiative in development, rather than a published national standard or a certification scheme.
Ask for evidence that matches the risk
At Suburban Secure, our practical recommendation is to start with the information and work the vendor will handle. A public events tool and a system holding student records, donor details or client case notes deserve different depths of review. A completed questionnaire helps organise a conversation; it does not make the decision for you.
Before adopting or renewing an important service, ask:
- Data: What information will you collect, where will it be stored, which subcontractors can access it, and is it used to train AI models?
- Access: Can we require MFA, assign appropriate roles, remove departing users promptly and inspect relevant access logs?
- Security maintenance: Who patches the service and its dependencies? What evidence can you provide of testing and remediation, including its date and scope?
- Incidents: Who contacts us, through which channel, and how will we receive updates if the affected product is also your support portal?
- Recovery: What recovery time and potential data loss should we plan for, and when was recovery last tested? Distinguish targets from contractual commitments.
- Exit: Can we export usable records and attachments, what does that cost, and how are remaining copies and backups handled after departure?
Look for shared points of failure
Two products can depend on the same cloud provider, identity service or communications platform. Ask what sits underneath the service and what happens if that dependency becomes unavailable. A vendor’s support team may be dealing with the same outage you are. Our sister business has a practical staff and customer communications guide following the 13 November Microsoft disruption.
Turn answers into a decision and a review date
Keep the vendor’s responses and supporting documents with your assessment. Record gaps, the person responsible for following them up, any agreed conditions and the person authorised to accept the remaining risk. Revisit the assessment at renewal and after a significant incident, ownership change or change in how your data is used.
Small businesses, charities and churches can use the same approach at a manageable scale. Begin with the few platforms whose loss would stop essential work or expose sensitive records. A short, evidenced assessment is more useful than a long form that nobody reads after procurement.
Learn with people doing the work
MITIE is an Australian community for ICT professionals in K–12 education, with a forum and professional learning activities. If you work in school ICT, explore MITIE and its membership options. Peer discussion can help sharpen the questions you take back to your own vendors.
Suburban Secure can help connect vendor dependencies, documented risks and practical actions through a technology review and governance and risk work.
