Vendor Risk Reviews Explained for US Start-ups

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• Under US$10,000, all-inclusive

  For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.

Sterling does the work end to end: the free gap assessment, policies and controls written to your practice, the evidence pack and answer library, an internal audit and coordination of the independent examination. The SOC 2 report is issued by a US-licensed CPA firm, as AICPA standards require. You deal with Sterling throughout, the people who consult never audit you, and our record over 20+ years and 8,100+ client engagements in 60+ countries is 100% success and on-time completion.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

What the fee covers, and what it doesn't:

• It is the fee for your first SOC 2 report or your first certification only.
• Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
• It assumes a typical start-up or SME scope: one product or service and one main location.
• Larger or multi-site scopes get a fixed quote after the gap assessment.
• PCI DSS is quoted separately: a fixed quote follows a free gap assessment.

^[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.

The outcome. You go into a US buyer's review prepared, so approval comes in days of focused work rather than weeks of back-and-forth.

A vendor risk review, also called third-party risk management or a security review, is how a US customer decides whether a supplier can be trusted with its data, systems or customers. For a start-up, it is the gate between the business sponsor's yes and a signed contract. The sponsor may love the product; the review can still decline, or approve with conditions.

It produces three things:

• A decision. Approve, approve with conditions, or decline.
• A risk rating. How closely you will be watched afterwards.
• Conditions. Terms that end up in the contract.

This guide describes the process from the supplier's side. If you also buy software, the same stages apply in reverse.

The outcome. You understand why a US reviewer wants documents, not just answers, and you supply them first time.

In several US regimes, a customer must oversee its own service providers, and your answers become the evidence it keeps on file:

• Financial customers: FTC Safeguards Rule. A covered company must oversee service providers by taking reasonable steps to select and retain providers able to maintain appropriate safeguards, requiring them by contract to maintain such safeguards, and periodically assessing them based on the risk they present (16 CFR 314.4)^[1].
• Health customers: HIPAA. A covered entity may let a business associate handle electronic protected health information only with satisfactory assurances, documented in a written contract or other arrangement; the same duty runs from a business associate to its own vendors (45 CFR Part 164, Subpart C)^[2].
• Public companies: SEC Regulation S-K Item 106. A registrant must describe its processes for assessing and managing material cybersecurity risks, including whether it has processes to oversee and identify such risks associated with its use of any third-party service provider (17 CFR 229.106)^[3].

You do not need to master these rules. You need to know your reviewer is often building a file that proves diligence. Other regimes, such as state financial regulators and card-brand rules, add their own versions; ask the buyer which rules drive its program.

The outcome. A clear map of what comes next, so nothing in the review surprises you. The stages are Sterling's description of the common pattern, not a regulatory standard.

The outcome. Evidence that reads consistently, so the reviewer clears lines instead of opening follow-ups.

Most reviewers are not hunting for perfection; they look for consistency and for signals of how much more work you need.

• SOC 2 report. The AICPA describes the SOC 2 examination as covering the service organization's system and its controls relevant to security, availability, processing integrity, confidentiality or privacy^[4]. Reviewers usually read the scope first, then the opinion, then any exceptions. The SOC 2 report is issued by a US-licensed CPA firm, as AICPA standards require, and lets a reviewer skip many questionnaire lines, though not all: they still check your product sits inside the scope.
• Policies and records. Written, approved and followed. A policy with no matching record is a flag.
• Consistency. If the questionnaire says all staff train annually and the policy says new hires within 90 days, expect a follow-up call.
• Subprocessors. Which vendors touch the customer's data, where and on what terms; your own vendor reviews are part of the evidence.
• Incident handling. A specific account of how you detect and respond does better than a claim that nothing has ever gone wrong.

In Sterling's consulting experience, these cost the most time:

• Answering from memory. Different people give different answers across questionnaires. Keep one approved library with an owner.
• Overstating status. A planned control described as in place; one discovered overstatement makes a reviewer re-rate everything else. Say in place, in progress with a date, or not planned.
• Scope mismatch. A SOC 2 report that excludes the product being bought helps less than expected.
• Oversharing. Reports and test summaries should go out under confidentiality, and be tracked.
• No owner. Reviews answered by whoever is free, usually an engineer, usually late.
• One-off thinking. Annual reassessment is normal, and a lapsed report restarts the questions.

For questionnaires in depth, see answering security questionnaires.

The outcome. A standard review becomes a routine task rather than a deal risk. Build these, in order of payoff: 1. Evidence pack. Current report or attestation, policy index, a short architecture and data-flow description, subprocessor list and your latest penetration test or vulnerability assessment summary. 2. Answer library. With an owner and review dates, covering access, encryption, logging, incident response, backup, vendor management and privacy. 3. One-sentence status. For example, "SOC 2 Type 2 observation period in progress, report expected after the period closes". See SOC 2 for Series A. 4. Contract positions. What you will accept on breach notice, audit rights and data return, and who approves exceptions. 5. Your own vendor reviews. Customers will ask to see them.

The same artifacts serve US investors and procurement teams; compliance for enterprise deals and security questionnaires shows how they fit.

This is Sterling's recommendation, not a requirement of any regulator. 1. Assemble the evidence pack and answer library before your first large review, not during it. 2. Name one owner for reviews, and make that person the single editor of the library. 3. Be exact about status; a dated plan lands better than an overstatement. 4. Match your attestation scope to the product buyers purchase. 5. If US enterprise reviews keep asking for a SOC 2 report, plan one; see the SOC 2 hub and the ISO/IEC 27001 hub.

Facing a review on a live deal? Get started and we will show which parts of your evidence already satisfy reviewers.

A SOC 2 engagement has one deliverable that no consultant can hand you: the report. The SOC 2 report is issued by a US-licensed CPA firm, as AICPA standards require^[1]. What Sterling does is make sure you get there ready, and that nothing between today and the report lands on your desk.

With Sterling, you deal with one team from start to finish. We coordinate:

• a readiness review and a gap assessment against the Trust Services Criteria;
• the policies, procedures and controls you need, written for how your company actually works;
• evidence collection, so the examination does not become a scramble;
• an internal audit before the examiner arrives, carried out by people who did not advise you on the controls;
• the Type 1 or Type 2 path that fits your deal timeline, and the examination itself, including scheduling, requests and follow-ups.

Our experts bring 30+ years of experience, and the firm has completed 8,100+ client engagements in 60+ countries over 20+ years. You get a single plan, a single point of contact and a clear view of what happens next.

^[1] SOC (System and Organization Controls) Suite of Services. AICPA & CIMA. accessed October 23, 2026.

• SOC 2: standard overviewStandard overview
• ISO/IEC 27001: standard overviewStandard overview
• HIPAA: standard overviewStandard overview
• NIST CSF: standard overviewStandard overview
• Clear US Enterprise Security Reviews and Questionnaires FastUnited States
• Meet US Contract, MSA and RFP Compliance Clauses FastUnited States
• How US Start-ups Answer Security Questionnaires FastUnited States
• SOC 2 for Series A: What Founders Need and WhenUnited States
• SOC 2 vs ISO 27001 for US Companies: Which to Start WithUnited States
• Sterling in the United StatesUnited States

1. 16 CFR 314.4, Standards for Safeguarding Customer Information: Elements. eCFR. accessed October 23, 2026.

2. 45 CFR Part 164, Subpart C, Security Standards for the Protection of Electronic Protected Health Information (sections 164.302 to 164.318). eCFR (US National Archives and Records Administration / GPO). accessed October 23, 2026.

3. 17 CFR 229.106 (Regulation S-K Item 106), Cybersecurity. eCFR. accessed October 23, 2026.

4. SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy. AICPA & CIMA. accessed October 23, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.