# Vendor Security Review Kit

Fictional example, not actual customer or transaction data.

| Review area | Question | Evidence requested | Finding | Follow-up |
| --- | --- | --- | --- | --- |
| Identity | How are external recipients verified? | Current configuration documentation | Needs confirmation | Test intended recipient route |
| Access | Can former reviewers retain access? | Permission and removal process | Documented; not tested | Run approved sample test |
| Assurance | What assessment covers this service? | Report scope and review period | Not provided | Ask authorised contact |
| Exit | How are files exported and retained? | Export and deletion process | Partly explained | Clarify backup handling |