what things would you ask if doing a 3rd party application review. Eg should we use this companies application and is it secure.

  • 2
    Hi Rebecca, welcome to Information Security. Your question is immensely wide open, and as it stands can't really be answered in any useful, definitive fashion. Can you narrow down your question a bit, be more specific? Both about you (the company), the application, what kind of review, etc. But don't expect anybody to give you a complete guidebook on how to do a security review...
    – AviD
    Jun 24, 2016 at 1:06
  • @Rebecca: Welcome. I'm sorry but your question is not very clear. You need to provide more details and make your question more specific.
    – lepe
    Jun 24, 2016 at 1:06
  • Oh crap, I voted to approve @GhostSpeaks101's edit before seeing the full context. GhostSpeaks101 edited the question so it fits his answer - that's totally not cool. I understand the question is vague, but please let the OP add the clarification, don't make assumptions for her. Jun 24, 2016 at 2:21
  • 2
    @GhostSpeaks101 No worries, welcome to InfoSec, happy to have you! I'm not an expert in this area so I can't tell the difference between "what she meant" and "what you think she meant". We're a little squeemish (maybe too much so?) about letting people inject buzz-words into other people's questions since often they end up with a less general answer than they wanted. Jun 24, 2016 at 2:53
  • 2
    Rebecca, if you're reading this, please do come back and add some clarification, we really would like to answer your question! Jun 24, 2016 at 2:54

1 Answer 1


As I understand correctly, you are asking about what all details you'd be asking when you are doing an assessment of 3rd party engagement (3PE).

There are circumstances around this question like what SLAs are in place and what level of details the vendor will be providing to you etc. However I feel following details should be asked without fail.

  1. Where the application will be hosted?
  2. What level of data sensitivity we are looking at?
  3. Who all will have access to the application!?
  4. How the credentials/access will be managed?
  5. Will the vendor be needing a remote connection to your network, ever?
  6. How the data will be protected at rest and in transit?
  7. Will there be any data transfers (ftp/sftp etc)
  8. Architecture/process flow diagrams, technical solutions documents if any.

These are the basic questions I think I can equip you with, however based on the application/service engagement you'll have to figure out what you'd be asking to ensure the engagement doesn't cause information security breach at your network or any loss in client data.

Hope this helps.

Not the answer you're looking for? Browse other questions tagged .