What documents should you request from a supplier?

The evidence requested should match the relationship’s risk. Common items include a security questionnaire, relevant SOC 2 reports, ISO 27001 certificates and scope statements, penetration-test summaries, security and resilience policies, insurance evidence, and a current subprocessor list. Higher-risk relationships may require additional evidence or contractual assurance. No single document proves the supplier is safe for every use case.