Can you audit our third-party vendors for security?
Key takeaways
- A third-party security audit typically costs Rs 40,000 to Rs 2,50,000 per vendor depending on depth, and is quoted per vendor rather than per engagement.
- India recorded 77 ransomware attacks between January and June 2026 (Cyble CRIL, reported by Fortune India, 23 July 2026), with supply chain a growing entry route.
- Evidence review matters more than questionnaire answers, because a signed questionnaire from a vendor that was breached is worth very little.
- Privileged access to your environment is the single item to check on every vendor, including whether the vendor still needs it.
- 83% of Indian organisations have not begun comprehensive DPDP implementation, so vendor contracts rarely contain adequate data processing terms yet.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does a third-party security audit actually cover?
Five areas. First, a control questionnaire mapped to a named framework, which is only a starting point rather than the assessment. Second, an evidence review, because a vendor's control is only as real as the artefact it produces, and a screenshot is not a log, a policy is not a configuration and a certification is not a current attestation. Third, breach and disclosure history, including any CERT-In or public disclosure, any dark web appearance of the vendor's credentials, and any prior incident the vendor has not disclosed. Fourth, credential and privileged-access testing, focused on what the vendor's accounts can reach in your estate. Fifth, software supply-chain and dependency review, checking for known vulnerable components and unmaintained packages in what the vendor supplies you.
Why are vendors the front door now?
Because the attacker does not need to defeat your controls, only your supplier's. Indian ransomware operations in 2026 have consistently reached large enterprise customers through IT vendors, logistics partners, payroll processors and managed service providers, and the pattern is consistent: compromise a supplier that already has privileged access, then move laterally. The scale of the problem is also a staffing problem, since 57% of Indian security providers struggle to hire AI-security specialists and 73% of organisations cannot fill roles, so many suppliers are operating with the same thin security coverage as their customers. The relevant statistic is that 83% of Indian organisations have not begun comprehensive DPDP implementation, which means most vendor contracts still lack proper data processing terms, audit rights and breach-notification deadlines.
How do I build a vendor risk register that is actually useful?
Start with a tiering that reflects exposure rather than spend. Tier one is every vendor that has privileged access to your production environment, holds your customer or patient data, or is on the payment path, and these get a technical audit annually. Tier two is vendors holding data or with network connectivity, which get a questionnaire and evidence review annually or on a two-year cycle. Tier three is everything else, which gets an annual standard questionnaire and a monitoring check for breach mentions. For each vendor, record the tier, the last audit date, the findings raised, the remediation status, the data shared and the contractual notice period. That register is what makes the next audit cheaper, because you are not starting from zero each year.
How often should vendors be re-audited?
Annually for tier one, at minimum, and immediately on any of four triggers: a vendor announces a breach, a vendor is acquired or changes ownership, a new system or data category is shared, or a failed audit finding is not remediated by its due date. For tier two, on a two-year cycle with annual questionnaire refresh, and for tier three, an annual questionnaire plus monitoring. The retest matters as much as the cadence, because a vendor that failed to remediate a finding last year and is not retested will simply fail again, and the register will show a growing list of findings nobody is tracking.
| Vendor tier | Examples | Audit cost (ex-GST) | Re-audit frequency |
|---|---|---|---|
| Tier 1, privileged access or payment path | Managed service provider, payment gateway, payroll vendor | Rs 1,20,000 - 2,50,000 | Annually, plus on incident |
| Tier 2, holds data or has connectivity | CRM provider, ticketing SaaS, cloud reseller | Rs 60,000 - 1,20,000 | Every 1-2 years |
| Tier 3, low exposure, no data | Facilities, courier, non-sensitive SaaS | Rs 40,000 - 60,000 | Annually, questionnaire only |
| Continuous monitoring add-on | Breach mentions, dark web credential exposure, certification status | Rs 20,000 - 40,000 per year | Continuous |
What are the frequently asked questions?
Get a straight answer on this
Send us your vendor list with the systems each one touches, and we will return a tiering, a per-vendor audit plan and a fixed price for the first tier.
Send us the details See pricing