Vendor Risk Assessment for Australian SaaS Startups
A vendor risk assessment is the check you run before trusting a supplier with your data or your uptime. For a small Australian SaaS team the whole thing fits in an afternoon: list every vendor, tier them by what they can reach, demand evidence only from the top tier, and record the decision. Under Australian Privacy Principle 8 you remain accountable for personal information you disclose to an overseas provider, which for most Australian SaaS means almost every vendor on the list.
Almost everything written about vendor risk assessment is written for a bank with a dedicated third-party risk team, a ratings platform subscription and 4,000 suppliers. You have 40 suppliers, no risk team, and a customer asking whether you have a vendor management process. What follows is the version that fits.
What is a vendor risk assessment?
A vendor risk assessment is a structured check on what a supplier could do to your business if they were breached, went down, or handled your data badly. It covers security, privacy, availability and the exit path, and it ends in a written decision to use the vendor, use them with conditions, or not use them.
For a SaaS company the stakes are more direct than for most businesses, because your vendors are inside your product. Your authentication provider, your database host, your email sender, your logging platform and your support desk all process data your customers believe you hold. When your customers run their own vendor assessment on you, these are the companies they are really asking about.
The output is not a score. It is a decision and a record of why you made it. A spreadsheet row that says “approved, SOC 2 Type 2 reviewed 14 March 2026, next review March 2027” satisfies an auditor and a customer. A ratings dashboard with no decision attached satisfies neither.
How do you tier your vendors without a risk team?
You tier vendors by what they can reach, not by how much you pay them. A tool that holds customer personal information or has privileged access to production is high risk even if it costs fifty dollars a month. A tool your designers use for mood boards is low risk even on an enterprise plan.
Three tiers is enough for a company under 100 staff:
| Tier | What qualifies | What you ask for | Review cycle |
|---|---|---|---|
| Critical | Holds customer personal information, or has privileged access to production, or your product stops without it | Current SOC 2 Type 2 or ISO 27001 certificate, security contact, breach notification terms, sub-processor list | Annually |
| Important | Holds internal company data or staff personal information, but your product survives an outage | Public security page or trust centre, confirmation of multi-factor authentication and encryption, data location | Every 2 years |
| Low | No access to your data or systems, easily replaced | Nothing beyond a note of what it does and who owns it | On change only |
Most teams find the exercise reassuring. A typical 25-person Australian SaaS has 40 to 60 vendors, of which perhaps five are critical. You are not assessing 60 suppliers. You are assessing five properly and listing the rest.
The tiering conversation also tends to surface shadow vendors, the tools someone expensed on a personal card eighteen months ago that now holds a copy of your customer list. Finding those is often worth more than the assessment itself.
What does Australian privacy law require of your vendors?
Under Australian Privacy Principle 8, if you disclose personal information to an overseas recipient you must take reasonable steps to ensure that recipient does not breach the Australian Privacy Principles, and in most cases you remain accountable for what they do with it. Australian Privacy Principle 11 separately requires you to take reasonable steps to protect the personal information you hold.
For an Australian SaaS company this is not a theoretical obligation. If your database runs in a United States region, your support desk is hosted offshore and your email sender is overseas, APP 8 applies to each of them. The practical consequence is that you need to know, for every critical vendor, where the data physically sits and what contractual commitments you have obtained.
The OAIC quick reference to the Australian Privacy Principles sets out APP 8 and APP 11 in full. Three things to capture for every critical vendor:
- Where the data is stored and processed. Region, not just country of incorporation. See our guide to data sovereignty for Australian SaaS.
- Who their sub-processors are. Your vendor’s vendors still touch your customers’ data, and your own customers will ask for the list.
- What they commit to on breach notification. A vendor who notifies you in 72 hours and one who notifies you when convenient are very different risks against a 30 day assessment deadline.
Capture these once, in writing, and the answer to the next customer questionnaire is already written. Our guide to answering vendor security questionnaires covers the other direction of the same conversation.
How do you run the assessment in an afternoon?
You run a vendor risk assessment in an afternoon by working from your expense data rather than memory, tiering before you investigate, and demanding evidence only from the critical tier. The sequence below is what most small Australian SaaS teams can complete in a single sitting.
- Export the list. Pull every recurring payment from your accounting system and every application connected to your identity provider. The union of those two lists is your real vendor inventory, and it will be longer than the one in your head.
- Assign an owner to each. One named person per vendor. Unowned tools are how subscriptions outlive the people who bought them.
- Tier them. Critical, important, low, using the test above. Ten minutes per vendor at most, and most take ten seconds.
- Collect evidence for the critical tier only. Request the current SOC 2 Type 2 report or ISO 27001 certificate, the sub-processor list and the data residency details. Most vendors publish these. Our guide to reviewing a SOC 2 report covers what to look for beyond the cover page.
- Record the decision and the next review date. This is the step people skip, and it is the only step an auditor can actually test.
Where you keep the register matters less than keeping it. A spreadsheet in your document management system works, and is what most Australian SaaS companies at this size use. If you are already heading toward ISO 27001 or SOC 2 and want the supplier register sitting alongside your controls and evidence, a purpose-built tool such as CertAssist, at US$375 per month, includes a built-in suppliers register and connects to none of your systems. An enterprise compliance platform automates more but reads your environment on standing credentials. The spreadsheet remains a perfectly defensible choice at this size.
Common questions about vendor risk assessment
When should a vendor risk assessment be performed?
Perform a vendor risk assessment before you sign, not after. The point of leverage is during procurement, when you can still ask for a security addendum or walk away. Reassess critical vendors annually, and out of cycle whenever the vendor suffers a breach, changes ownership, or you start sending them a materially different type of data.
How often should vendors be reassessed?
Annually for critical vendors, every two years for important ones, and on change for the rest. Trying to reassess everything annually is how vendor management programmes collapse in small companies. A short, honest cycle you actually complete beats a thorough one you abandon in month four.
What is the difference between vendor due diligence and vendor risk assessment?
Vendor due diligence is the one-off investigation before you sign, covering security, financial stability and legal terms. Vendor risk assessment is the ongoing evaluation that continues through the relationship. In small companies they are often the same meeting held at different times, but auditors expect to see evidence of both.
Do you need a vendor risk assessment for SOC 2 or ISO 27001?
Yes. Both expect you to evaluate and monitor suppliers who can affect your security. ISO 27001 Annex A covers supplier relationships explicitly, and SOC 2 examines vendor management under the common criteria. A supplier register with tiers, evidence and review dates satisfies both, which is why it is worth building before either audit rather than during one.
What if a critical vendor has no SOC 2 or ISO 27001?
Not every good vendor is certified, particularly smaller Australian ones. Ask instead for their security documentation, a completed questionnaire, penetration test evidence and their breach notification commitment. Then record a reasoned decision accepting the gap, with a named approver and a review date. A documented accepted risk is defensible. An undocumented one is not.
How many vendors does a typical Australian SaaS company have?
More than its founders expect. Teams of 20 to 30 commonly find 40 to 60 paid tools once they combine the accounting export with the identity provider list, and the discovery exercise is usually the most valuable part of a first assessment. Expect to cancel several subscriptions nobody was using.
Build the register before a customer asks for it
Vendor risk assessment is one of the few security practices that pays back immediately. It finds unused subscriptions, surfaces tools nobody owns, answers half of every customer security questionnaire, and gives you most of what ISO 27001 and SOC 2 want from supplier management. For a small team it is also the natural first step toward ISO 27001 for a small Australian business.
Siege Cyber helps Australian SaaS companies and startups build security programmes that fit the size of the team, not the size of the template. Have a look at our cyber security advisory services, or get in touch if a customer has just asked for your vendor management process and you do not have one yet.