ไทย
Menu

Vendor risk check · 12 questions · 3 minutes

If your vendor disappeared tomorrow, could you carry on?

Twelve yes-or-no questions about the system someone else built for you. Each answer that isn't a yes lets water into one of four compartments, and a no lets in twice as much as not sure. You get the result and what to fix first, straight away.

A OWNERSHIP B ACCESS C RECOVERY D KNOWLEDGE WL
Fig. 01 · Four watertight compartments

Sheet 01

Twelve questions

Your answers stay in this page's address. Nothing is stored unless you choose to send the result to us.

A OwnershipIs it yours on paper?
  1. 01The source code is in a repository your organisation owns, not the vendor's account.
  2. 02Your organisation holds the admin accounts: the domain, cloud hosting, app store developer accounts and LINE OA.
  3. 03Your contract says the code and its IP become yours once you have paid.
B AccessCan you get in without asking?
  1. 04Someone on your team can sign in to the servers and the database today, without asking the vendor.
  2. 05Passwords and keys live in a password manager or secrets store, not in chat or email.
  3. 06You could remove the vendor's access in an afternoon, and be sure you got all of it.
C RecoveryCould you bring it back?
  1. 07Backups run automatically, and someone has restored one in the last six months.
  2. 08You hear about an outage from an alert, not from your users.
  3. 09A new release can be deployed from written steps, by someone other than the person who built it.
D KnowledgeDoes anyone else understand it?
  1. 10There is current documentation: how it is built, how to run it, and what it connects to.
  2. 11Automated tests exist, so a change can be checked without clicking through everything by hand.
  3. 12At least two people understand how the system works, and not all of them work for the vendor.

Answer all twelve to see the result.