Identify potential. Assess risks. Secure decisions.

Due Diligence: Structured IT Vendor Assessment

Thorough due diligence is the key to successful outsourcing.

  • 01Comprehensive assessment of vendors against standardised criteria
  • 02Identification and assessment of risks prior to contract conclusion
  • 03Fulfilment of regulatory requirements (e.g. MaRisk, BAIT, EBA Guidelines)
  • 04Sound decision-making basis for your vendor selection
View services
11+Years of experience
120+Employees
540+Projects
ISO 27001certified

IT Vendor Due Diligence: Structured Assessment

A professional IT vendor due diligence uncovers risks before they become problems. Our structured assessment evaluates IT security, data protection compliance and operational capabilities of potential service providers — from initial screening to the final due diligence report.

Our due diligence offering encompasses the development of individual review methods, the execution of structured assessments, and the documentation and evaluation of results. We support you in assessing vendors against all relevant criteria and provide sound decision-making bases.

3 service modules

What we take on for you

Bookable individually or as an end-to-end programme.

01

Financial Due Diligence

Comprehensive review of the financial stability and business development of potential vendors.

  • Analysis of annual financial statements and key financial metrics
  • Assessment of financial stability and profitability
  • Review of business model and future viability
  • Analysis of investments and financial planning
02

Operational Due Diligence

Assessment of the vendor's operational capability, processes, and resources.

  • Analysis of capacities, skills, and resources
  • Assessment of process maturity and quality management
  • Review of emergency and continuity measures
  • Assessment of organisational structure
03

Compliance & Security Due Diligence

Review of compliance with regulatory requirements as well as IT and data security.

  • Assessment of compliance management and governance
  • Review of data protection compliance
  • Assessment of IT security and information protection
  • Analysis of certifications and audit results

5 phases

Our Approach

Our approach to due diligence reviews is systematic, thorough, and tailored to your specific requirements.

  1. Definition of the review scope and evaluation criteria

  2. Development and distribution of tailored due diligence questionnaires

  3. Document review, interviews, and on-site assessments where applicable

  4. Analysis and evaluation of the information gathered

  5. Preparation of due diligence reports with recommendations for action

Sarah Richter

Your contact

Sarah Richter

Head of Information Security, Cyber Security

10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security

+49 69 913 113-01 info@advisori.de LinkedIn
Sound due diligence is the best investment in successful vendor relationships. It creates transparency, minimises risks, and lays the foundation for long-term partnerships that endure even under difficult conditions.

Our Strengths

  • 01Many years of experience in conducting due diligence reviews
  • 02Industry-specific know-how and regulatory expertise
  • 03Structured methodology and proven assessment procedures
  • 04Comprehensive documentation and decision-oriented reporting

Expert Tip

Thorough due diligence should not be limited to document review alone. On-site visits, interviews with key individuals, and independent reference checks provide valuable insights that go beyond the obvious.

7 QUESTIONS, BRIEFLY ANSWERED

Frequently asked questions about Due Diligence

What is IT due diligence for vendor selection?

IT due diligence is a systematic assessment of potential IT vendors before contract signing. It evaluates IT security posture, data protection compliance, technical capabilities and operational risks. In regulated industries (banking, insurance), it is mandatory under MaRisk AT 9 and EBA outsourcing guidelines. The assessment typically includes document review, questionnaires, interviews and on-site audits for critical outsourcing arrangements.

What should be on a vendor due diligence checklist?

A vendor due diligence checklist covers: IT security certifications (ISO 27001, SOC 2, TISAX), data protection compliance (GDPR, data processing agreements), financial stability and business continuity, disaster recovery and business continuity plans, references and track record, subcontractor management, regulatory requirements (MaRisk, DORA, NIS2) and exit strategies with data return procedures.

What regulatory requirements apply to outsourcing due diligence?

In financial services, MaRisk (AT 9), BAIT and EBA outsourcing guidelines require documented due diligence before any outsourcing arrangement. Since January 2025, DORA (Digital Operational Resilience Act) adds ICT third-party risk assessment requirements. Cross-industry, GDPR mandates data processor assessments, and NIS2 imposes supply chain security obligations for critical infrastructure operators.

How long does a vendor due diligence process take?

Duration depends on complexity and criticality. A basic screening takes 2 to 4 weeks, while a comprehensive due diligence for critical IT vendors takes 6 to 12 weeks. Regulated organisations face longer timelines due to additional compliance checks. A risk-based approach prioritises assessment depth by criticality — not every vendor requires a full-scope review.

What is the difference between IT due diligence and vendor due diligence?

IT due diligence focuses on technical aspects: IT architecture, security concepts, software quality and technical debt. Vendor due diligence is broader and also covers financial stability, compliance, operational capabilities and strategic fit. For IT outsourcing, both overlap: the IT due diligence becomes a core component of the comprehensive vendor due diligence assessment.

What cybersecurity aspects are assessed in due diligence?

Key cybersecurity assessment areas include: information security management system (ISMS per ISO 27001), access control and authorisation concepts, encryption (data at rest and in transit), network security and segmentation, patch and vulnerability management, security monitoring and incident response capabilities, backup and disaster recovery, and penetration test results and audit findings.

How does ADVISORI support IT vendor due diligence?

ADVISORI supports the entire due diligence process: from developing tailored assessment frameworks and questionnaires through conducting assessments (document review, interviews, on-site audits) to delivering the final due diligence report with risk ratings and recommendations. Our team brings regulatory expertise (MaRisk, BAIT, DORA, NIS2) and sector-specific knowledge from financial services and IT.