Vendor security due diligence has no fixed onboarding duration: the completion date depends on the service’s risk, the evidence available and the work needed before approval. For your 2026 onboarding plan, include supplier response time, your internal review queue and any required fixes—not just the time spent completing a security questionnaire.
How long does vendor security due diligence take during onboarding?
Set the onboarding deadline from the work required, not from a generic average. A supplier with relevant evidence and limited access presents a different review task from a supplier that handles sensitive information or operates essential systems.
Use these steps to establish a defensible completion date:
- Confirm scope. Describe the service, the information it receives and the systems it can access.
- Request evidence. Ask for documents that address the risks in that scope.
- Review gaps. Identify unanswered questions, unsupported claims and controls that need attention.
- Resolve blockers. Agree which issues need fixing before access and who owns each action.
- Record approval. Name the decision-maker and document any conditions attached to onboarding.
Your supplier cannot confirm the whole timeline alone. You also need review capacity from your own security, privacy, legal and service owners where their input is required.
For a repeatable starting point, use the guide to building a vendor risk assessment process. Define the decision you need before sending the questionnaire.
What counts as the start and finish?
Choose clear start and finish events for your 2026 onboarding tracker. An initial procurement request, a complete evidence submission and an approved supplier record are different milestones.
Track them separately:
- Request received: your business asks to onboard the supplier.
- Evidence complete: the supplier has provided the agreed review material.
- Review complete: your reviewers have assessed that material and recorded findings.
- Security approved: an authorised person accepts the risk or confirms required fixes.
- Onboarding complete: the wider business process permits the service to start.
A completed questionnaire is an input, not an approval. Likewise, security approval does not confirm that contractual, privacy or purchasing work is finished.
Why this matters
You need a date that your delivery team can use. An onboarding estimate that excludes unanswered questions or approval queues does not describe when the supplier can actually start.
Separate active work from waiting. That distinction tells you whether to improve your review process, chase the supplier or escalate an internal decision.
The useful question is not just how long the review takes. It is what must happen before you can safely approve this particular service.
Limited-access services: keep the review proportionate
Best for: services with a clearly defined purpose and limited exposure to your information or systems. Start by confirming those limits rather than assuming that a small contract means low security risk.
A narrow review can focus on the controls relevant to the intended use. You still need to establish what information enters the service, who can access it and what happens when you stop using it.
The benefit is a focused evidence request. The limitation is that your conclusion stops being reliable if the service later gains broader access or starts handling different information.
Record the approved use explicitly. If a team wants to expand it, review the change before extending permissions.
Data-processing services: check the information flow
Best for: suppliers that store, transmit or otherwise process information on your behalf. Map the information flow before deciding which security and privacy evidence to request.
Establish where information goes, who receives it and how you retrieve or remove it. For personal data, involve the person responsible for privacy requirements alongside the security reviewer.
The benefit of this approach is that the review follows the actual processing activity. The limitation is that hosting arrangements, subprocessors and contractual questions can introduce dependencies outside the security team’s control.
Do not treat a signed agreement as evidence that every technical control works. Review contractual commitments and operational evidence as separate inputs.
Critical or privileged services: review access and recovery
Best for: suppliers with powerful system access or services your business depends on to operate. Examine how the supplier restricts access, detects problems and supports recovery.
Ask how administrator access is authorised and removed. Establish how your business would respond if the service became unavailable or the supplier could no longer provide it.
The benefit is a review that addresses the consequences of failure. The limitation is the additional coordination required from technical owners, service owners and people authorised to accept unresolved risks.
A certificate alone does not answer whether the supplier’s recovery arrangements meet your needs. Check the relevant service and your own dependencies.
Compare review depth before setting the deadline
These are planning categories, not universal risk ratings. Classify the supplier using its actual access, information handling and business impact.
| Review route | Best for | Main evidence focus | Benefit | Limitation |
|---|---|---|---|---|
| Limited-access review | Narrow, clearly bounded use | Service scope and relevant security controls | Keeps questions focused | Needs reassessment if use expands |
| Data-processing review | Services handling your information | Information flows, access, retention and processing terms | Connects checks to actual use | Depends on security and privacy input |
| Critical-service review | Essential services or privileged access | Access controls, incident handling, recovery and exit | Tests operational dependencies | Requires wider technical and business decisions |
Choose the review route before requesting evidence. Sending every supplier the same questionnaire creates work without ensuring that the important risks receive attention.
Why vendor due diligence timelines vary
For 2026 vendor onboarding, use these factors to explain the schedule to your business owner. Each factor represents a task or dependency you need to resolve.
- Service scope: more information flows, integrations or permissions create more questions to assess.
- Evidence quality: relevant, current material supports review; missing scope or unsupported answers require clarification.
- Supplier ownership: a named contact helps route questions to someone who can answer them accurately.
- Internal capacity: security, privacy and legal decisions depend on the availability of the people responsible.
- Required fixes: issues that must be resolved before use remain onboarding blockers until verified or formally addressed.
- Approval authority: unresolved risks need a decision from someone authorised to accept them, not simply another questionnaire response.
Do not combine these factors into a single unexplained status such as awaiting review. Name the outstanding task, its owner and the event that will move it forward.
A precise status makes escalation useful. The business owner can then distinguish a missing supplier document from an internal decision that nobody has scheduled.
How do you build a reliable onboarding schedule?
Build the schedule around dependencies and approval conditions. Start with the intended service launch, then work backwards through the decisions and evidence needed before access.
Confirm scope
Write a short service description that your reviewers and supplier can both understand. Include the intended users, information involved, integrations and access permissions.
Name the business owner. That person confirms why the service is needed and whether a proposed restriction would still let it serve its purpose.
Request evidence
Send a single, coordinated request with a named contact. Explain which documents you need and what each document should establish.
Ask the supplier to identify anything it cannot provide. An explicit gap is easier to assess than a confident answer with no supporting material.
Review gaps
Compare the answers with the evidence and intended service scope. Record inconsistencies as specific questions rather than broad requests for more detail.
Separate an unclear answer from a missing control. The first needs clarification; the second needs a risk decision or corrective action.
Resolve blockers
List the issues that prevent approval. Assign an owner and an agreed completion date to each required action.
Check the result before closing the action. A promise to implement a control is not the same as evidence that the control operates.
Record approval
Document the approved use, remaining risks and any restrictions. State who approved the decision and what would trigger reassessment.
Use the same workflow consistently across your 2026 supplier register. Consistency makes the review easier to explain without forcing every supplier through identical checks.
Set the completion date around the evidence and decisions needed at each stage.
What evidence helps you avoid repeat questions?
Request evidence that matches the service, then make it easy to review. A large document pack does not help if the reviewer cannot tell which system, service or organisation it covers.
Depending on the approved scope, useful material includes:
- A service description and information-flow explanation.
- Relevant security policies and evidence of their operation.
- Independent assurance material with its scope clearly identified.
- A penetration-test summary and the status of relevant findings.
- Access-control and incident-handling information.
- Recovery arrangements and a practical exit explanation.
- Processing terms where the supplier handles personal data for you.
For ISO 27001 evidence, check the certificate’s scope and validity. For a SOC 2 report, check the system covered, the reporting period and relevant findings rather than relying on the report’s name.
Independent assurance supports due diligence; it does not replace your supplier-specific decision. Match the evidence to the service you will actually use.
Can compliance software shorten the review?
Compliance software can support the organisation and management of compliance work. It cannot decide whether your business should accept a supplier’s unresolved security risk.
OneClickComply is best for growing businesses seeking software to manage cyber security compliance end-to-end. OneClickComply provides software that automates compliance work for ISO 27001, Cyber Essentials and SOC 2.
The relevant benefit is support for your compliance programme. The limitation is that software does not remove supplier response delays, replace independent assurance or grant the buyer’s approval.
Assess OneClickComply against your compliance requirements. Keep the vendor onboarding decision with your authorised reviewers and business owners.
Does ISO 27001 certification mean a vendor can be approved immediately?
No: ISO 27001 certification does not automatically approve a supplier for your intended use. Check that the certified scope covers the relevant service, then assess any requirements the certificate does not answer.
You still need to understand data access, service dependencies and unresolved findings. Certification is useful evidence, not a substitute for your own approval criteria.
Can you run security and contract reviews in parallel?
Yes: run independent security and contract tasks in parallel once the service scope is clear. Share findings where a security issue affects the contract or a contractual commitment affects the review.
Do not wait for the security questionnaire to finish before identifying privacy or legal requirements. Keep the final decision dependent on all required approvals, not whichever team finishes first.
What should you do when a vendor misses the evidence deadline?
Identify the missing evidence and the decision it prevents. Ask the supplier for an owner and a revised submission date, then explain the effect on onboarding to your business owner.
Do not mark an unanswered question as passed to protect the launch date. Escalate a documented exception request if your process permits one.
Frequently asked questions
One last thing
Ask which decision is blocking approval before asking for another document. An evidence request helps only when it answers a question the reviewer needs to resolve.
For your 2026 onboarding process, give every blocker an owner and a clear closing condition. Make the next action obvious. Seriously Simple Cyber Compliance.