Which evidence should a supplier keep ready?
As of:
For every requirement that customers typically raise, a supplier should have current evidence at hand: certificates and audit reports for information security, the data processing agreement and technical and organisational measures for data protection, contingency and continuity plans for operations, and information on quality, finances and sustainability. Which areas this covers is shown by the Vendo4u catalog with 10 categories.
Why evidence instead of a mere self-assessment
Buyers must be able to justify their choice of supplier – to internal audit, supervisory authorities or their own customers. A ticked box without evidence carries little weight. This applies especially where the law requires a review: for processors under Art. 28(1) GDPR (sufficient guarantees) and in the supply chain under Section 30(2) BSIG.
The areas at a glance
The Vendo4u catalog organises the requirements into 10 categories with a total of 69 criteria. Below is what each category is about; the individual criteria are listed on the assessment criteria page.
Products, services & quality · 8 criteria
Quality management, conformity to requirements and the handling of defects and complaints.
Logistics & delivery capability · 7 criteria
Lead times, delivery terms and the ability to deliver reliably and flexibly.
Commercial terms · 6 criteria
Payment and delivery terms and the commercial framework of the cooperation.
Technical capability & capacity · 4 criteria
Manufacturing depth, capacity and development competence – largely industry-specific.
Information security · 10 criteria
Technical and organisational measures for protecting information.
Data protection (GDPR) · 8 criteria
Compliance with the EU General Data Protection Regulation and related rules.
Financial stability & insurance · 6 criteria
Creditworthiness, insurance cover and economic key figures.
Risk management & business continuity · 8 criteria
Contingency management, availability and transparency about dependencies.
Sustainability & compliance (ESG) · 10 criteria
Environment, social, governance plus supply-chain due diligence and material compliance.
Additional certifications & standards · 2 criteria
Additional industry and management standards with valid evidence.
Typical evidence per area
Information security: an ISO/IEC 27001 certificate including its scope, the summary of a recent penetration test, policies on access protection and multi-factor authentication, a documented vulnerability and patch management process.
Data protection: the data processing agreement under Art. 28 GDPR, the technical and organisational measures under Art. 32 GDPR, the list of sub-processors with the place of processing and, where required, the appointment of a data protection officer.
Business continuity: contingency and recovery plans, evidence of tested backups and, where applicable, an ISO 22301 certification.
Quality, environment and supply chain: ISO 9001 or ISO 14001 certificates, a supplier code of conduct, a policy statement on human rights and the environment, ESG ratings.
Commercial: an extract from the commercial register, proof of insurance such as general and cyber liability, information on financial stability.
What matters with evidence
Validity: certificates and reports carry an issue date and often an expiry date. An expired piece of evidence is worthless to the customer.
Scope: a certificate only covers what is within its scope. If it does not cover the service the customer obtains, it helps little.
Issuer: for certifications, it matters who certified – usually an accredited certification body.
Upkeep: if you keep evidence with expiry dates in one place, you renew it in time instead of noticing at the next customer request that it is out of date.
Recording evidence on Vendo4u
On Vendo4u, suppliers upload evidence directly at the matching criterion – as PDF, JPG or PNG up to 10 MB. For documents with an expiry date, the platform sends a reminder before they expire. The documents are visible only to the company itself and to buyers on a paid plan.
Sources
- Regulation (EU) 2016/679 (GDPR), Art. 28 and 32
- Section 30 BSIG – risk management measures
- ISO/IEC 27001 – information security management systems
General information, not legal advice. The statutory text in its current version is authoritative.