Initiales Vendor-Onboarding

These checklists are used for the systematic evaluation and review of SaaS providers and cloud services in the context of our law firm, particularly taking into account the special requirements for professionals bound by professional secrecy in accordance with the GDPR and Section 203 of the German Criminal Code (StGB).The checklists are divided into two stages:

- Initial vendor onboarding: Compact questionnaire for quickly recording the most important security and compliance aspects of a provider. Ideal for the initial assessment and selection of potential service providers.
- Vendor Security & Compliance Questionnaire: Comprehensive list of technical, organizational, and legal questions, including special AI security requirements. This is used for in-depth review and documentation prior to signing a contract.
The lists help to identify risks at an early stage, comply with data protection regulations, and ensure the security of our IT landscape.

Vendor Basic Information

Vendor Name

Brief description of the service

Compliance / Data Protection

Is a signed Data Processing Agreement (DPA) in place?

Yes

In which country is the data stored?

Are important certificates (e.g., ISO 27001, SOC 2, BSI C5) in place?

Yes

Access & User Protection (Security Access)

Is SSO/SAML integration (e.g., via Azure AD or similar) supported?

Yes

Is Multi-Factor Authentication (MFA) mandatory (e.g., for admin accounts)?

Yes, mandatory for all users

Yes, mandatory for admin accounts only

Optional / configurable

Does the system provide granular rights and user management?

Yes, comprehensive (role-based and customizable)

Yes, but limited

Are emergency (‘break glass’) accounts available?

Yes, with defined policies and controls

Yes, but without defined policies

Is logging of administrator accesses implemented?

Yes, comprehensive (all admin activities logged and auditable)

Yes, but limited

Data Protection & Strorage

Is encryption in transit (e.g., TLS 1.2/1.3) ensured?

Yes, TLS 1.2 and TLS 1.3 supported

Yes, TLS 1.2 only

Other encryption protocol in place

Other

Is encryption at rest (e.g., AES-256 or similar) implemented?

Yes, AES-256 (or stronger)

Yes, weaker encryption standard

Other encryption method in place

Are personal data processed? (If yes, please specify which ones)

Is vendor support access regulated and logged?

Yes, fully regulated and logged

Yes, but only partially regulated/logged

Operations & Backup

Are regular backups performed? (If yes, please specify frequency)

Is data export supported (e.g., CSV, JSON)?

Is disaster recovery / restore tested and possible? Describe.

Security Operations

When was the last external penetration test conducted? (Please specify year/month)

Is a vulnerability management process in place?

Yes, comprehensive

Yes, partially

Is an incident response process documented?

Yes, fully documented

Yes, partially documented

Is security monitoring (e.g., SIEM, log analysis) active?

Yes, comprehensive

Yes, partially

AI & Sensitive Data (if AI Funktions Are Relevant)

Is customer data used for AI training?

Yes

Is isolation of customer data in AI systems ensured?

Yes, fully ensured

Yes, partially

Documentation

Are proof or certificate copies available as PDF?

Yes