What the vendor can reach
Systems, data types, user roles, admin privileges, integrations, shared accounts, remote access, and customer-facing dependencies.
Vendor Review
Know which third parties can create security, privacy, or operational exposure.
AgileCT helps leadership decide whether a software tool, IT provider, processor, or outsourced service has enough proof to be approved, renewed, or escalated.
What We Review
What proof exists
Security summaries, audit reports, insurance, privacy terms, breach process, downstream providers, backup posture, and incident notification commitments.
What happens if it fails
Operational dependency, revenue impact, privacy exposure, contractual obligations, customer commitments, and realistic recovery options.
What Changes The Price
Vendor count
Data sensitivity
Criticality
Evidence follow-up
Final pricing depends on vendor count, data sensitivity, vendor criticality, evidence availability, renewal timing, required stakeholder interviews, and whether follow-up questions or approval conditions need tracking.
Check which package fits
Share the vendor type, data access, renewal timing, and evidence you already have so we can size the review.
Assessment Output
Turn vendor uncertainty into a reviewable decision.
Risk tier for each vendor based on access, data sensitivity, dependency, geography, evidence quality, and business criticality.
Questions to ask the vendor when evidence is missing, stale, vague, or inconsistent with the role they play in your environment.
Approval recommendation: proceed, proceed with conditions, require fixes, defer, or escalate for leadership review.
Follow-up tracker for owner, due date, requested proof, alternative safeguards, renewal timing, and next review date.
When It Helps
New software purchase
Assess a tool before it gets access to customer data, finance data, identity, email, or production systems.
IT provider review
Understand remote access, admin responsibility, backup support, logging, escalation, and incident notification gaps.
Privacy processor check
Review vendors that handle personal information, cross-border storage, subprocessors, or customer-facing data flows.
Renewal or consolidation
Compare vendors before renewal, reduce duplicate tools, and document why a high-risk vendor remains approved.
Packages
Single Vendor Review
$1,500-$3,500
Assess one high-impact vendor and produce a risk summary, evidence gaps, questions, and approval recommendation.
Vendor Review Sprint
$4,500-$9,500
Review a priority vendor set, tier risk, identify missing proof, and build a follow-up plan for owners and renewals.
Quarterly Vendor Review
Scoped
Maintain a recurring review rhythm for critical vendors, stale evidence, exceptions, renewal windows, and new third-party approvals.
Prepare for the review
Bring the vendor context and the available evidence.
Start with the vendor's service, the business owner, approval or renewal deadline, data types, system access, and the impact of an outage. Include the contract and security documentation you are authorized to share.
The review produces a vendor risk summary, evidence gaps, follow-up questions, a recommendation, and an owner-based action tracker. See sample evidence and remediation tables.
Your organization makes the approval and risk acceptance decisions. This is a review of the agreed scope and available records, not a penetration test, legal review, or independent assurance over the vendor's controls.
The Canadian Centre for Cyber Security's cloud and outsourced IT guidance provides a starting point for service security questions. The depth of a vendor review depends on the actual access, data, and business dependency.
Common questions
What if the vendor's evidence is incomplete?
We record the missing evidence, identify what it prevents us from concluding, and prepare follow-up questions or proposed conditions. Missing evidence stays unresolved until the requested proof is reviewed or an authorized owner records a risk decision.
Does a SOC 2 report mean a vendor can be approved?
A report is one input. We check its scope, period, exceptions, and relevant customer responsibilities against how you use the vendor. The recommendation also considers data access and operational dependency; your organization retains the approval decision.
Service information updated . Meet the consultant and read the service boundaries.
Next Step