vet-a-vendor

Vendor due diligence with cited evidence is performed by scoring a supplier against your rubric or generating a compliance research report. The process outputs evidence-cited markdown files with URLs for every claim and explicit insufficiency markers when evidence is missing.

Compliance research verifies security frameworks by triangulating claimed security or compliance frameworks with independent verification. It identifies security leadership and surfaces public incidents from the last three years.

To run a vendor risk assessment you need to provide the operations context and have web research connectivity. This allows the skill to gather evidence from public sources, marketing pages, and news to evaluate commercial fit and compliance.

Yes, you can use this for risk-sensitive checks on data processors, infrastructure, and regulated services. It applies to vendor selection, supplier scoring against internal criteria, and verifying compliance for these sensitive categories.

Vendor compliance reports are generated as evidence-cited markdown files. They are output to either an evaluations or compliance-reports directory with a supplier slug, containing URLs for every claim and explicit insufficiency markers for missing evidence.