Tools and providers
Part of PR tools and providers for agencies: a 2027 guide to workflow fit and data provenance
PR agencies vendor due diligence: software supplier checks
PR agencies vendor due diligence for software suppliers: an evidence checklist covering identity, media data, rights, security, accessibility and exit.
PR agencies vendor due diligence is a request for evidence, not a questionnaire that a sales team can pass by ticking boxes. For a PR agency buying software for media-relations work, each answer needs an owner, review date, scope, limitation and expiry. Set numeric minimums for critical controls only after the consequences of failure are understood.
Record the review date, service version and evidence expiry. This checklist does not assess or approve a supplier.
What to take away
- Vendor due diligence is a request for evidence, not a questionnaire that sales can tick.
- Each answer needs an owner, dated record, scope, limitation and expiry.
- Set minimum thresholds only after understanding the consequences of failure.
- Map controller and processor roles per activity, not a single label.
- If a critical control cannot be demonstrated, record a no-go.
Confirm who would supply what
For a media-relations shortlist, examples of products to vet include Cision, Meltwater and Muck Rack. This is an illustrative list, not an endorsement or assessment; apply the checks to the exact product, edition and modules proposed.
- Obtain the legal name, company number, registered address and order-form entity.
- Match the service, edition, modules, territory, users and client accounts to the quote.
- Save every incorporated term, data schedule, licence and precedence clause.
- Check filing status through Companies House without treating registration as endorsement or financial assurance.
- Where applicable, obtain the supplier’s ICO registration number and check the legal entity against the ICO’s public register of fee payers; record the listed status and fee tier without treating registration as a security endorsement.
Stop if the brand cannot be linked to the proposed contracting party or if a material module exists only in sales copy.
Supplier identity checks
- Legal name and company number
- Registered address and order entity
- Match services to quote
- Save terms and data schedules
- Check Companies House filing status
Trace media and client data
Request a field-level map for supplier media profiles, buyer-uploaded contacts, pitches, notes, replies, monitoring content and user telemetry. It should state source category, collection date, verification route, purpose, recipient, location, retention and correction process. Ask to inspect how a person can object, correct or be removed and how that change reaches saved lists.
The ICO’s right to be informed guidance says an organisation using data obtained elsewhere should identify the source as specifically as possible. A public biography or work email does not remove the need to establish the proposed processing.
Map controller and processor roles per activity. Do not accept a single label for supplier database creation, buyer uploads, email integration, service analytics and outreach. Where a processor relationship exists, compare the proposed data processing agreement and data schedule with Article 28 of the UK GDPR and the Data Protection Act 2018, and check them against the ICO guidance Contracts and liabilities between controllers and processors. A named privacy and Privacy and Electronic Communications Regulations (PECR) reviewer should also test the content, recipient and channel.
Examine rights and send controls
- Identify who owns buyer copy, contact notes, taxonomies, reports and configurations.
- Record the licence for supplier database fields and monitored content.
- Test whether a suppression can block scheduled distribution across users and client workspaces.
- Require an approval history for claims, attachments and later corrections.
- Ask what happens to licence-bound content in exports and backups.
The UK Intellectual Property Office’s Lambert Toolkit model agreements show why licence scope, permitted users, territory and duration need explicit treatment. Supplier access to content does not create a right to republish it.
Challenge operational assurances
Ask for evidence covering the exact service: identity controls, privileged access, audit logs, encryption, vulnerability management, incident notification, recovery tests and the full subprocessor chain. Use the NCSC Cloud Security Principles to frame cloud-service questions rather than relying on a vague claim of following an NCSC selection method. CAIQ, SIG Lite and the Vendor Security Alliance (VSA) questionnaire can structure evidence requests, but a completed questionnaire is not independent assurance. Ask for any relevant SOC 2 Type II report, ISO/IEC 27017 or ISO/IEC 27018 evidence, and a penetration-test report; where applicable, check whether the tester is accredited under NCSC CHECK or CREST. The ISO/IEC 27001 information security standard specifies requirements for a management system rather than a list of security controls, so ask for scope, auditor and validity dates. A published G-Cloud service definition, for example, records Cyber Essentials Plus and ISO 27001 certifications covering physical security, personnel security, storage, electronic data handling and secure destruction.
Accessibility is a separate pass or fail decision. Request a current conformance report against WCAG 2.2, with known defects, remediation dates and testing details for keyboard, screen reader, magnification, colour and error recovery; where public-sector work is in scope, ask how EN 301 549 is met. Run buyer-owned tasks with representative users. An assertion that a product was "built for accessibility" is not a test result.
Prove change and exit
Require notice for material product, source, subprocessor, hosting and terms changes. Define who can suspend use and what evidence permits restart. Agree numeric limits for retention and incident notification, and numeric recovery time objective (RTO) and recovery point objective (RPO) thresholds that match the buyer’s risk; put them in the contract rather than accepting unmeasured assurances. Before signing, export a synthetic case with provenance, approval, suppression and correction events; reopen it in the buyer’s chosen format. Test revocation of users and administrators.
The exit schedule should cover buyer data return, licence-bound fields, deletion timetable, backups, evidence of completion, transition help and unresolved complaints. If the supplier cannot demonstrate a critical control, record a no-go. Price, reputation or a broad security statement must not compensate for it.
Before you act
- Confirm the legal entity, Companies House filing status and, where applicable, ICO register entry; match services to the quote.
- Request a field-level map for all media and client data.
- Test suppression controls across users and client workspaces.
- Demand evidence for identity, access, encryption and incident response; review applicable CAIQ, SIG Lite or VSA responses and independent assurance.
- Agree numeric retention, incident-notification, RTO and RPO thresholds in the contract.
- Export a synthetic case with provenance and reopen it in your format.
- Define exit terms for data return, deletion and transition help.
Common questions
What should a buyer do if the brand cannot be linked to the proposed contracting party?
Stop. The article says to stop if the brand cannot be linked to the proposed contracting party or if a material module exists only in sales copy. This prevents proceeding with an entity that may not be legally responsible for the service.
How should a buyer handle controller and processor roles for different activities?
Map controller and processor roles per activity. Do not accept a single label for supplier database creation, buyer uploads, email integration, service analytics and outreach. Where a processor relationship exists, compare the proposed data processing agreement and schedule with Article 28 of the UK GDPR and the Data Protection Act 2018, and check them against the ICO guidance Contracts and liabilities between controllers and processors.
What evidence is needed to challenge operational assurances?
Ask for evidence covering the exact service: identity controls, privileged access, audit logs, encryption, vulnerability management, incident notification, recovery tests and the full subprocessor chain. A certificate or report needs its service scope, auditor or tester credentials, and validity dates. CAIQ, SIG Lite and VSA responses can structure requests but do not replace independent assurance. Accessibility requires a current conformance report and testing details.
