Security Review Checklist
Make a security review checklist for a new tool or vendor: what it touches, sign-in and access, data handling, vendor evidence and a recorded decision.
- Free
- No sign-up to try
- Works as you type
5 stages, 20 steps
1. Scope
- Write down what the tool does and who will use it
- List the data it will store or see, and how sensitive it is
- List the systems it connects to and the permissions it asks for
- Name a business owner and a technical owner
2. Access and sign-in
- Check it supports single sign-on or multi-factor sign-in
- Check roles can limit what each user sees and does
- Confirm you can remove a person's access in one place
- Check for audit logs of sign-ins and admin changes
3. Data handling
- Confirm data is encrypted in transit and at rest
- Find out where data is stored and which subprocessors handle it
- Check how long data is kept and how to delete it
- Confirm you can export your data if you stop using the tool
4. Vendor assurance
- Ask for their security documentation or independent audit reports
- Read how they handle and disclose security incidents
- Search for past breaches and how they responded
- Have the data processing terms reviewed by whoever handles contracts
5. Decision
- Record each risk found and how it will be handled
- Get sign-off from the person who owns security
- Apply the agreed settings before anyone starts using it
- Set a date to review the tool again
Free, no sign-up to try. Your checklist becomes a Room you can edit, publish and share.
How it works
How the Security Review Checklist works
- 1
Pick the stages
Keep the stages you need and name an owner for each.
- 2
Add your own steps
Add steps specific to your team or product.
- 3
Share the checklist
Create a Room everyone ticks off together from one link.
Worked example
What it makes
1. Scope
Know what the tool will touch before judging it.
- Write down what the tool does and who will use it
- List the data it will store or see, and how sensitive it is
- List the systems it connects to and the permissions it asks for
- Name a business owner and a technical owner
2. Access and sign-in
Only the right people get in, and you can see what they do.
- Check it supports single sign-on or multi-factor sign-in
- Check roles can limit what each user sees and does
- Confirm you can remove a person's access in one place
- Check for audit logs of sign-ins and admin changes
3. Data handling
Your data is protected, and you can get it back out.
- Confirm data is encrypted in transit and at rest
- Find out where data is stored and which subprocessors handle it
- Check how long data is kept and how to delete it
- Confirm you can export your data if you stop using the tool
4. Vendor assurance
The vendor runs security seriously, with evidence.
- Ask for their security documentation or independent audit reports
- Read how they handle and disclose security incidents
- Search for past breaches and how they responded
- Have the data processing terms reviewed by whoever handles contracts
5. Decision
A recorded decision, with the remaining risks accepted by someone.
- Record each risk found and how it will be handled
- Get sign-off from the person who owns security
- Apply the agreed settings before anyone starts using it
- Set a date to review the tool again
Who it's for
Who uses it
IT and security leads
Review every new tool against the same questions.
Team leads
Get a tool approved faster by answering the questions first.
Small companies
Do a sensible review without a security team.
Good to know
What to consider
- A starting point for a light review, not a full audit or compliance assessment.
- Tools handling sensitive or regulated data need a deeper review by a specialist.
Questions
About the Security Review Checklist
Is this enough for compliance?
No. It covers sensible questions to clear before adopting a tool. Compliance frameworks have their own requirements: add those steps or ask your compliance owner.
Where do the steps come from?
From a step library written and reviewed by people, not generated per visitor. Pick the stages you need, name an owner for each and add your own steps.
Make your checklist now
Free, no sign-up to try. It becomes a Room you can edit, publish and share.
Create my checklistRelated
Related tools
- Vendor Onboarding ChecklistMake a vendor onboarding checklist for a new supplier: documents, checks, finance setup, kickoff and a first review, with an owner for each stage.
- Vendor Evaluation ScorecardScore vendors against weighted criteria and get a ranked scorecard with the method shown, ready to share with stakeholders.
- Audit Report GeneratorAdd your findings and the evidence. Get an audit report as one link: scores by area, what you found, the gaps that matter and a prioritised action plan, with an AI agent that answers the client's questions.