Industry playbook

Vendor risk basics for professional services firms

Professional services firms are asked for evidence by their clients and rely on vendors to deliver. This playbook is the tidy middle ground, proportional, defensible and quick to run.

5 min read Updated 1 July 2026

What clients ask you for

Insurance, DPA, ISO 27001 or Cyber Essentials, sub-processor list, business continuity summary. Keep these live in Credbase and every RFP response takes minutes.

What you should ask your own vendors for

The mirror image. Freelancers: PI insurance and DPA. SaaS: SOC 2 or ISO 27001 and sub-processor list. Cloud infrastructure: security whitepaper and DPA.

A right-sized programme

  1. Register your top 20 vendors.
  2. Tier them by data sensitivity.
  3. Request core evidence via upload link.
  4. Set expiry reminders.
  5. Review annually, 30 minutes per tier 1.

Frequently asked questions

Put this into practice today.

Start a free Credbase workspace, add your first supplier and share a live evidence pack in ten minutes.