Vendor Due Diligence Intake Form

✓ Section A: Requestor Information

A1. Requestor name:

A2. Department:

A3. Date:

A4. Vendor name:

A5. Vendor contact (name, email, phone):

A6. Is this a new vendor or existing relationship?

New vendor

Existing vendor - renewal

Existing vendor - scope expansion

A7. Proposed contract start date:

A8. Proposed contract term (months/years):

A9. Estimated annual contract value (CAD):

✓ Section B: Business Purpose

B1. Describe the business need this vendor will address:

B2. What products or services will the vendor provide?

B3. Which business processes or functions will this vendor support?

B4. Is this vendor critical to business operations?

Yes - Operations cannot continue without this vendor

Partially - Degraded operations; workarounds possible

No - Convenient but not essential

B5. Are there alternative vendors or in-house solutions available?

No alternatives exist

Alternatives exist but switching would be difficult/costly

Alternatives are readily available

✓ Section C: Data & System Access

C1. Will the vendor access, process, store, or transmit any company data?

Yes

No → Skip to Section D

C3. Approximately how many records/individuals will be affected?

Not applicable

< 100

100 - 1,000

1,000 - 10,000

10,000 - 100,000

> 100,000

C4. Will data leave Canada or be accessible from outside Canada?

Not applicable

Yes - specify countries below

No

Unknown

C5. How will data be transferred to/from the vendor?

Not applicable

Secure file transfer (SFTP, encrypted)

API integration

Email

Physical media

Vendor accesses our systems directly

Other (describe below)

C6. Will the vendor have access to our internal systems or networks?

Not applicable

Yes - describe below

No

C7. Will the vendor have privileged or administrative access?

Not applicable

Yes

No

C8. Will the vendor's personnel work on-site at our facilities?

Not applicable

Yes - regularly

Yes - occasionally

No

✓ Section D: Subcontractors & Fourth Parties

D1. Will the vendor use subcontractors to deliver services or process data?

Yes

No

Unknown

D2. If yes, are the subcontractors known? List if available:

✓ Section E: Regulatory & Compliance Considerations

E1. Does this engagement involve data or processes subject to specific regulations? (Select all that apply)

PIPEDA / Provincial privacy laws

OSFI guidelines (B-10, B-13, etc.)

PCI-DSS (payment card data)

CASL (electronic messaging)

FINTRAC / AML requirements

Securities regulations

None / Unknown

Other (describe below)

E2. Has Legal reviewed this engagement?

Yes

No - required

No - not required

E3. Has Privacy reviewed this engagement?

Yes

No - required

No - not required

✓ Section F: Business Continuity Impact

F1. If this vendor became unavailable, what would be the impact?

Critical - Immediate significant business disruption

High - Business disruption within 24-48 hours

Medium - Degraded service; manageable for days/weeks

Low - Minimal operational impact

F2. What is the maximum tolerable downtime for this vendor's service?

< 4 hours

4 - 24 hours

1 - 3 days

> 3 days

F3. Do you have a contingency plan if this vendor fails?

Yes - documented

Yes - informal

No

✓ Section G: Financial & Reputational Exposure

G1. What is the potential financial impact if this vendor fails or causes a breach? (Consider fines, remediation, lost revenue)

> $1,000,000

$100,000 - $1,000,000

$10,000 - $100,000

< $10,000

G2. What is the potential reputational impact?

Severe - National media coverage, significant customer loss

Moderate - Industry/local coverage, some customer concern

Low - Internal awareness only

✓ Section H: Additional Information

H1. Are there any other risks or considerations we should be aware of?

H2. Has this vendor been assessed previously? If yes, when?

H3. Attach any relevant documentation (SOW, proposal, data flow diagrams, etc.)

✓ Section I: Attestation

I confirm that the information provided is accurate to the best of my knowledge.

Signature:

Date: