Your Vendor Has the Keys to Your Kingdom.
Do You Trust Them?

Two primary frameworks now mandate vendor risk management controls for Australian businesses. The Security of Critical Infrastructure (SOCI) Act 2018, as amended in 2022, requires responsible entities to identify, manage, and mitigate risks arising from third-party supply chain dependencies. ACSC Essential Eight v3 introduced strengthened requirements around third-party access controls, particularly at Maturity Level 2 and above, which increasingly applies to government contractors and regulated sector operators. Beyond these, the Privacy Act 1988 holds Australian businesses accountable for the handling of personal information by their vendors and service providers -- a business cannot outsource its Privacy Act obligations. This kit includes a dedicated BONUS document mapping every deliverable to these specific frameworks so you can demonstrate compliance with confidence.

A general security checklist tells you that vendor risk management is important and lists it as a checkbox item. This kit gives you the actual operational tools to do it: a 50-question security questionnaire to send to each vendor, a Red/Amber/Green scoring matrix to assess their answers, an onboarding checklist to verify controls before granting access, a formal policy document governing how third-party access works, and an annual review template to reassess vendors at contract renewal. The difference is the difference between knowing you have a gap and having the instruments to close it.

The fewer vendors you have, the faster this kit pays for itself. If you have three vendors with network access -- an IT managed service provider, an accounting firm, and a payroll processor -- those three vendors collectively hold the keys to your financial data, employee records, and entire IT infrastructure. The 2025 Ponemon Institute report found that 62% of data breaches involving Australian businesses included a third-party component. A small vendor list does not reduce your risk; it concentrates it. This kit takes under four hours to implement across a small vendor set and gives you documented, defensible proof that you assessed each vendor before granting access -- which matters to your insurer, your clients, and any regulator that comes asking.

Sapphire Sleet is a North Korean threat actor group that has been actively targeting Australian supply chains by compromising software packages distributed through public repositories. Their campaign exploiting CVE-2026-24434 in the axios npm package demonstrated that attackers are no longer trying to breach your business directly -- they are compromising vendors and software suppliers that have trusted access to your environment. If your IT provider, development partner, or SaaS vendor is compromised, the attacker inherits whatever access that vendor had to your systems. Formal vendor vetting, including reviewing vendors' own security practices and software supply chain controls, is now a direct defence against this class of attack. The BONUS case studies document in this kit covers this scenario with the specific lessons learned.

Yes -- and this is specifically how most Australian SMBs will use it. The majority of vendor risk exposure is with existing vendors who were onboarded informally years ago, before vendor security vetting was standard practice. The Vendor Security Questionnaire is designed to be sent to both new and existing vendors as part of an initial assessment cycle. The Annual Vendor Review Template then keeps those assessments current at each contract renewal. The Vendor Risk Scoring Matrix applies equally to new and existing vendors -- in fact, running existing vendors through the scoring matrix for the first time often surfaces critical gaps that have been present for years.

A vendor refusing to complete a security questionnaire is itself a significant risk signal -- and the Third-Party Access Policy Template in this kit establishes the principle that completing a security assessment is a condition of access. The questionnaire is structured to be proportionate: critical vendors with network access receive the full 50-question assessment; lower-tier vendors with limited data access receive a subset. A vendor who declines to answer questions about how they handle your data, whether they enforce MFA, or what their incident response process looks like is a vendor who cannot demonstrate the controls you are relying on them to have. The scoring matrix includes a specific handling procedure for vendor non-response.

Yes. Cloud vendors are included in the vendor risk scope and the questionnaire includes cloud-specific questions covering data residency, shared responsibility model boundaries, encryption at rest and in transit, and access control mechanisms. However, major cloud platforms (AWS, Microsoft, Google) typically satisfy most questionnaire items by way of their published compliance certifications (ISO 27001, SOC 2, etc.). The more significant risk with cloud vendors is usually configuration -- whether you have correctly implemented the security controls available to you, not whether the vendor has them. The Vendor Onboarding Checklist includes cloud configuration verification steps for the most common Australian SMB platforms.