A vendor-onboarding checklist is often the only control standing between a new supplier and your data. Yet many checklists collect generic attestations that cannot be mapped to the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC), and that give cyber underwriters little to verify at renewal. This article offers an NCA ECC third party risk checklist you can apply the same day: seven artifacts to require before contract signature, and three evidence formats that satisfy both NCA self-assessment and underwriters.
The NCA ECC includes a domain covering third-party and cloud computing cybersecurity. In practice, it expects you to show that you assessed a supplier before engaging it, that obligations are written into the contract, and that you can produce evidence on request. The principle is simple: collect it before signature, because leverage disappears afterwards.
How to use this checklist
Apply the list to vendors in your higher risk tiers first. A vendor that hosts regulated data or holds privileged access needs all seven artifacts. A low-risk supplier may need only a subset. Record each artifact against the vendor, with a date, a reviewer and an accept or reject decision.
Part 1: The seven due-diligence artifacts
Assurance and scope
- SOC 2 Type II report with scope confirmation. Ask for the full report, not a certificate or a badge. Confirm that the services you are buying fall inside the audited system boundary, check the audit period, and note any exceptions. A report that excludes your service proves little.
- Penetration-test summary. Request an executive summary from an independent tester, dated within the last twelve months, showing the scope, the severity of findings and remediation status. It shows whether the vendor tests the systems that will touch your data.
Data and location
- Data-residency declaration. Require a signed statement of where your data is stored, processed, backed up and accessed from, including support access from other countries. Saudi regulated institutions often face localisation and data-protection constraints, so this must be explicit and contractually binding.
- Sub-processor list. Obtain the current list of sub-processors and hosting providers, with their locations and roles. Add a commitment to notify you of changes. Your risk extends to the vendor's suppliers.
Response and resilience
- Incident-notification SLA. Define in writing how fast the vendor will notify you of an incident affecting your data or services, through which channel, and with what content. Make sure the timeframe lets you meet your own regulatory reporting duties.
- Business-continuity playbook. Collect the vendor's continuity and recovery plan for the service, including recovery objectives and the date of the last test. It shows whether an outage at the vendor becomes an outage for you.
Financial backstop
- Insurance certificate. Ask for current certificates covering cyber liability and professional indemnity, with limits and expiry dates. Underwriters look for evidence that risk transfer across your supply chain is real and not assumed.
Part 2: Three evidence formats under ISO 27001 Annex A.5.19
ISO/IEC 27001 Annex A.5.19 addresses information security in supplier relationships. Rather than building separate files for the NCA and for insurers, keep your evidence in three formats and tag each artifact to them.
- Questionnaire responses. Structured, dated answers signed by a named vendor representative. Use the same questions for every vendor in a tier, so answers are comparable and auditable.
- Contract clauses. The security obligations themselves: incident notification, data residency, sub-processor controls, audit rights, continuity and exit. A clause is stronger evidence than a statement of intent, because it can be enforced.
- Independent assessments. Third-party reports such as SOC 2 Type II and penetration-test summaries, or your own on-site or remote review. These carry the most weight with underwriters because they do not rest on the vendor's word.
A practical mapping helps. The SOC 2 report and penetration-test summary are independent assessments. The residency declaration, sub-processor list and notification SLA belong in questionnaire responses and are then fixed in contract clauses. The continuity playbook and insurance certificate are supporting documents attached to the vendor record. One record per vendor then serves self-assessment and renewal alike.
Common gaps to check for
- Reports collected after signature, when you can no longer decline or negotiate.
- Certificates accepted without checking scope or dates.
- Residency statements that ignore remote support access.
- Sub-processor lists with no change-notification duty.
- No named owner for chasing expired documents.
Making the checklist stick
A checklist only works if procurement cannot proceed without it. Make the artifacts a gate in the purchasing workflow, assign a reviewer in cybersecurity, and set a reassessment date at onboarding. Clear ownership and reporting lines also matter, and our Cybersecurity Governance & Organization service addresses that governance side. Where an ISO 27001 programme is in place, align the checklist to your Statement of Applicability so supplier controls are traceable.
How CISO Consulting helps
We set up and run your third-party cyber risk program: vendor tiering, due-diligence questionnaires, contract clauses, assessments and ongoing monitoring. Our process runs through four steps: inventory vendors, services and data shared; tier them by risk; assess with questionnaires, evidence and reviews; and monitor through a reassessment cycle with issue tracking.
Deliverables include a third-party risk policy and procedure, a tiered vendor register, a questionnaire library, a contract security schedule and vendor assessment reports. Setup takes 4–6 weeks, then continues on an ongoing retainer. The work is aligned to SAMA CSF and NCA ECC.
If your onboarding checklist still relies on generic attestations, the Third-Party & Supply-Chain Cyber Risk service is the place to start.
