Review a Third-Party Vendor Before Contract Renewal
Assess a vendor's security evidence, data flows, reliability history and exit options before renewal, then record a decision with named owners and dated follow-ups.
Objective
Decide whether to renew, renegotiate or replace a vendor using security, reliability, data-handling and exit evidence rather than sales claims.
Environment
- A current inventory of vendor integrations, data flows and contract owners
- Access to the vendor's trust portal, audit reports and subprocessor list
- The signed master agreement, data processing addendum and renewal notice dates
- Incident history from your own monitoring and the vendor's status page
- A security, legal and engineering reviewer for the final decision
Steps
1. Map the integration and data flow
Document which systems send data to the vendor, what categories of data are involved, where it is stored and which teams depend on the integration.
Expected state: A data flow diagram and system inventory exist for the vendor and are reviewed by the integration owner.
2. Collect assurance evidence
Download the latest SOC 2 Type II or ISO 27001 report, the penetration test summary and the subprocessor list, and check the report period covers the current year.
Expected state: Evidence covers the current audit period and any exceptions have a remediation statement.
3. Review contract and data terms
Check the data processing addendum, breach notification window, data residency, deletion commitments, liability cap, renewal notice period and termination assistance.
Expected state: Each clause is marked acceptable, negotiable or unacceptable with a legal reviewer named.
4. Check reliability and support history
Compare the vendor's published uptime against your own monitoring, review major incidents and support response times, and check whether status updates matched reality.
Expected state: The measured availability meets the service level and incident communications are rated.
5. Score and decide
Score security, data handling, reliability, exit and commercial terms with weighted criteria, then choose renew, renegotiate or replace and record the rationale.
Expected state: A signed decision record states the choice, conditions and the owner of each follow-up action.
6. Prepare the exit or renewal path
If renewing, calendar the notice date and negotiate the flagged clauses; if replacing, document the export format, migration plan and data deletion confirmation.
Expected state: The renewal notice date is owned by a named person and the exit plan has a tested data export.
Decision points
Should the vendor be renewed while a security gap remains?
- Renew with a contractual remediation deadline
- Do not renew until the gap is closed
Renew only with a dated remediation clause, a right to terminate on failure and a compensating control on your side; otherwise start the replacement evaluation.
Should the vendor's standard data processing terms be accepted?
- Accept the standard terms
- Negotiate residency, deletion and breach notice
Negotiate when the vendor processes regulated or customer data; standard terms rarely meet a short breach notification or deletion obligation.
How much weight should pricing carry?
- Price is the primary factor
- Price is one of five weighted factors
Cap commercial weight at fifteen percent; switching costs and security gaps routinely exceed the discount that motivated the renewal.
Expected outcome
A documented renew, renegotiate or replace decision with evidence, named owners, contract dates and a viable exit path.
Verification
Confirm the decision record cites current audit evidence, the notice date is on the owner's calendar, and a sample data export from the vendor opens in your own tooling.
Cleanup
Store the evidence pack with the contract record, remove temporary vendor access granted for the review, and schedule the next review before the following renewal window.
Renewal is a decision, not a calendar event
Most vendor reviews happen after the renewal has already been approved by default. Start eight weeks before the notice deadline, assemble evidence, and give the reviewers enough time to ask for missing documents. The decision is not only about price: a vendor that processes customer data carries your regulatory risk, and a vendor that owns a critical integration carries your availability risk.
Score with evidence
Use a small weighted model and require a citation for each score. The template below keeps the review comparable across vendors and makes disagreement visible.
security 30% audit report, pen test, access model, encryption
data handling 25% residency, subprocessors, retention, deletion, DPA
reliability 20% measured uptime, incident history, support response
exit 15% export format, transition assistance, deletion proof
commercial 10% price, renewal uplift, termination feesSafety checks
Read the audit report’s scope and exceptions, not just the cover page; a SOC 2 report can exclude the very subsystem you depend on. Check the subprocessor list against your own data residency commitments. Confirm the breach notification window is compatible with your regulatory deadline. Test the export path with a real sample before renewal, because exit plans that have never been executed are marketing claims.
Rollback and irreversible steps
A renewal decision can be reconsidered until the contract is signed. Once signed, the irreversible commitments are the term length, the termination fee and any prepayment; negotiate those before signature and keep a copy of the prior contract terms. If the vendor is being replaced, do not cancel the old contract until the data export has been verified and the replacement has run in parallel for one billing cycle. Record the notice dates so the next review does not start late.