Due Diligence for IT Service Providers: What to Expect and How to Handle It Efficiently

If you are an IT service provider supplying regulated companies, you will be assessed before the contract is signed, and again and again afterwards. Banks, insurers, critical infrastructure (KRITIS) operators and public sector clients must demonstrably assess and monitor their service providers. For you, this means extensive due diligence questionnaires, tight deadlines and answers that must withstand scrutiny.

This article explains what to expect in a due diligence process, where the typical hurdles lie and how Tendry significantly reduces the effort involved.

‍

What due diligence involves for IT service providers

In a due diligence process, your client assesses whether you operate securely, reliably and in compliance with regulations as a service provider. For financial entities, this is mandatory: DORA requires a risk assessment and due diligence of the ICT third-party service provider before entering into a contract, followed by monitoring throughout the entire contract term (DORA Art. 28, Luther). Clients subject to NIS2 must also secure their supply chain and their direct service providers (NIS2 Art. 21) and pass these requirements on to you.

‍

A due diligence process typically works like this:

1. Request: Your client sends a questionnaire, usually as an Excel file or via a supplier portal.
2. Response: Your team answers the questions and compiles supporting evidence.
3. Follow-up questions: The client reviews the answers and requests additional information or evidence.
4. Assessment: The client classifies you as a service provider. The result feeds into the contract decision.
5. Recurring review: Depending on the risk classification, your client reassesses you at regular intervals throughout the contract term.

‍

These topics are almost always covered:

• Information security management, certifications and policies
• Access and authorization concepts, encryption, network security
• Data protection, data locations and subcontractors used
• Business continuity management, backup and recovery
• Handling of security incidents and reporting channels
• Vulnerability management and penetration testing
• Personnel security and training
• Audit and inspection rights as well as exit strategies

Typical evidence includes certificates (e.g. ISO/IEC 27001), audit reports, policies, business continuity plans, penetration test summaries, subcontractor lists and data processing agreements.

‍

The typical challenges

Most questions are not difficult. What is difficult is finding the right answer quickly and phrasing it the same way every time.

Knowledge is scattered. The answers are buried in old questionnaires, policies, certificates, emails and the minds of individual colleagues. Every new request starts with a search.

Many stakeholders, little time. Sales, Security, IT Operations, Data Protection and Legal all work on the same questionnaire. Versions are sent back and forth by email, responsibilities are unclear and deadlines slip.

The same questions, worded differently. Every client uses its own format and its own wording. The questions overlap heavily in content, yet the research often starts from scratch.

Inconsistent answers. If the same question is answered differently in two questionnaires, follow-up questions arise. In the worst case, the client’s trust suffers.

Answers must be verifiable. In regulated industries, a statement alone is not enough. Your client expects evidence and will cross-check your information in later reviews.

It never ends. After the contract is signed, annual reviews, audits and follow-up requests on changes follow. The effort grows with every new client.

‍

How much effort is involved?

A security questionnaire often comprises several hundred questions. Even standardized formats show the scope: the Cloud Security Alliance’s CAIQ contains 261 questions, and even the short version, CAIQ-Lite, still has 124 (Cloud Security Alliance).

In Germany, many clients, particularly financial institutions, use their own questionnaires, usually as Excel files and often with reference to DORA or NIS2. Formats and wording vary from client to client, but the topics overlap considerably.

Without a centrally maintained knowledge base, the effort can quickly add up to several working days per questionnaire, spread across different departments. On top of that come follow-up questions and evidence requests that trigger a second round.

This is where the greatest potential for savings lies: once your knowledge is properly organized, you no longer have to piece it together for every questionnaire.

‍

How this works in Tendry

With Tendry, you store your knowledge once and answer every subsequent questionnaire on that basis, with traceable sources. Suggested answers are ready in minutes instead of after days of research.

1. Build your knowledge base: Upload policies, certificates, technical documentation and previously answered questionnaires. Tendry uses them to build your verified knowledge base.
2. Upload the questionnaire: Upload your client’s questionnaire as an Excel file. Tendry recognizes the questions, in more than 30 languages.
3. Generate answers: Tendry creates a suggested answer for each question based on your knowledge base. Every answer is linked to the source it comes from.
4. Review and refine: Your team reviews the suggestions. If Tendry cannot find a sufficient basis, the question is flagged for review instead of an answer being invented. Using the chat for each question, you can adjust answers precisely.
5. Export: Export the completed questionnaire in its original format. Excel in, completed Excel out.

‍

What this means for your team:

• Less searching: Knowledge is stored centrally in one place instead of being scattered across documents and inboxes.
• Consistent answers: Everyone works from the same approved knowledge, across clients and teams.
• Verifiable statements: For every answer, you can see immediately what it is based on. This makes follow-up questions and later reviews easier.
• Faster next time: Approved answers are saved and available again for the next request, the next audit or the annual review.
• Full control: Tendry provides the suggestion, your team decides and approves.

The security your clients expect: Tendry is ISO/IEC 27001 certified. All data is processed and stored exclusively in Germany and is not used to train public AI models.

‍

Conclusion

For IT service providers with regulated clients, due diligence is not a one-off project but an ongoing task. Starting every questionnaire from scratch costs time, risks contradictions and slows down your own deals. Storing your knowledge in a structured way once lets you answer requests faster, consistently and with verifiable sources.

Tendry is live. See for yourself how you can get suggested answers for your next security questionnaire in minutes instead of spending days on research: Start for free

‍

‍

Sources

• DORA, Art. 28 – General principles on ICT third-party risk (Springlex)
• Luther Rechtsanwaltsgesellschaft: DORA – Overview
• NIS2 Directive, Art. 21 – Cybersecurity risk-management measures (Springlex)
• Cloud Security Alliance: What is CAIQ?

‍