Vendor due diligence plan and contract clauses (ClevSec Pro)
vendor_due_diligence_planRead-onlyIdempotent
Use after vendor_risk_assessment when the user needs to act on a vendor's gaps. Returns every gap with an action, the evidence to request from the vendor, ISO 27001 / GDPR / NIS2 / DORA references and a roadmap (before signing first), plus the contract clauses to include (GDPR Art. 28, NIS2 Art. 21, DORA Art. 30 when they apply). Requires ClevSec Pro.
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "vendor_due_diligence_plan"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| bcp1 | No | Does the vendor have a business continuity / disaster recovery plan? | |
| bcp2 | No | Does the vendor offer a defined SLA with uptime guarantees? | |
| bcp3 | No | Can data be exported/migrated if you terminate the relationship? | |
| bcp4 | No | Does the vendor have geographic redundancy for critical services? | |
| bcp5 | No | Is the vendor financially stable (no signs of distress)? | |
| com1 | No | Is the vendor compliant with GDPR (if processing EU personal data)? | |
| com2 | No | Will the vendor sign a Data Processing Agreement? | |
| com3 | No | Does the vendor provide right-to-audit or access to audit reports? | |
| com4 | No | Does the vendor's contract include security requirements and SLAs? | |
| com5 | No | Does the vendor have adequate insurance coverage (cyber liability)? | |
| inc1 | No | Does the vendor have a documented incident response plan? | |
| inc2 | No | Will the vendor notify you of security incidents within 24-48 hours? | |
| inc3 | No | Has the vendor experienced any data breaches in the last 3 years? | |
| inc4 | No | Does the vendor conduct incident response exercises/tabletop tests? | |
| sec1 | No | Does the vendor hold relevant security certifications (ISO 27001, SOC 2, etc.)? | |
| sec2 | No | Does the vendor have a documented information security policy? | |
| sec3 | No | Does the vendor encrypt data at rest and in transit? | |
| sec4 | No | Does the vendor enforce multi-factor authentication? | |
| sec5 | No | Does the vendor conduct regular penetration testing? | |
| sec6 | No | Does the vendor have a vulnerability management program? | |
| sec7 | No | Does the vendor perform background checks on employees with data access? | |
| sup1 | No | Does the vendor disclose its key subprocessors/subcontractors? | |
| sup2 | No | Will the vendor notify you before changing subprocessors? | |
| sup3 | No | Does the vendor assess the security of its own suppliers? | |
| sup4 | No | Are subprocessor contracts held to the same security standards? | |
| regimes | No | Which of these apply to your organization? (optional) | |
| dataAccess | No | What data will this vendor access? | |
| vendorType | No | Type of service | |
| criticality | No | How critical is this vendor to your operations? |