Vendors & cloud: checklist and advice

Last updated: 18 October 2026 · IT-Checklist editorial team · All changes

A small business now runs on dozens of outside services, such as email, accounting, a web shop, scheduling and telephony. Each one is handy. Together they decide how vulnerable you are. If one supplier goes bust, gets hacked or doubles its prices, you notice straight away.

This topic is about overview and fallback options. Where is your data, who can get to it and what do you do when a supplier drops out?

Check where your business stands on vendors & cloud

The free IT check asks you these questions. Then you see your score per topic and advice for every gap. You don't need an account.

Start the IT check →

Why this matters

Is a domain name or certificate registered to a former employee or your previous web designer, and does it quietly expire? Then your website and email go down in one go.

In invoice fraud, criminals send an invoice that looks real, or a 'changed bank account number' from a supplier you know. You rarely get the money back.

The 9 questions in this topic, with advice

Each question describes the situation you want to have. The label shows how much the measure weighs in your score. 'Do first' counts the most.

We have an overview of all cloud services and vendors we use.
Recommended
List all subscriptions and services, including costs, contact person and where your data resides.
Critical domain names, hosting and certificates are registered to the company and do not expire unnoticed.
Important
Verify your domain name is registered to the company (not an old web agency) and put expiry dates in your calendar.
We can export our data from every cloud service if we want to switch.
Recommended
Test for each important service whether you can export your data in a usable format. This prevents vendor lock-in.
For important vendors we know how they handle security and backups.
Recommended
Ask vendors about certifications (e.g. ISO 27001), where data is stored and their recovery plan for outages.
Invoices and payment requests from vendors are checked for authenticity (invoice fraud).
Important
Always verify changed bank account numbers via a known phone number and use the four-eyes principle for large payments.
For critical vendors we know what the alternative is if they stop, go bankrupt or suffer prolonged outages.
Recommended
Determine a plan B per critical service: an alternative vendor, a local copy of your data or a manual fallback procedure. Think about this before you need it.
Contracts and agreements with key IT vendors are accessible and up to date (notice period, support, recovery times).
Recommended
Store contracts centrally and note notice periods and support agreements. During an outage you want to know what to expect, not have to search for it.
When choosing new software or services we assess security and privacy in advance, not just price and features.
Recommended
Create a short checklist for new services: MFA available? Where is the data stored? Data processing agreement? Export option? Five minutes of checking prevents years of trouble.
Vendor access to our systems is limited to what is needed, temporary where possible, and revoked afterwards.
Important
Give vendors their own account (no shared admin password), limit the permissions and revoke access when the job is done. Vendor access is a favourite backdoor.

Where to start

Put all cloud services and suppliers in one list. For each one, note the cost, contact person, contract term and where your data is stored.
Check that your domain names, hosting and certificates are in the company's name and renew automatically.
Agree that a changed bank account number is always checked by phone, using a number you already had.
Remove temporary supplier access as soon as their job is done.

Common mistakes

Choosing a new service on price and features, without looking at security, privacy and how you would get out again.
Only finding out when you cancel that you can't export your data in a usable format.
Giving an IT partner permanent admin rights on every system without keeping track of when they are used.

Vendors & cloud: checklist and advice

Why this matters

The 9 questions in this topic, with advice

We have an overview of all cloud services and vendors we use.

Critical domain names, hosting and certificates are registered to the company and do not expire unnoticed.

We can export our data from every cloud service if we want to switch.

For important vendors we know how they handle security and backups.

Invoices and payment requests from vendors are checked for authenticity (invoice fraud).

For critical vendors we know what the alternative is if they stop, go bankrupt or suffer prolonged outages.

Contracts and agreements with key IT vendors are accessible and up to date (notice period, support, recovery times).

When choosing new software or services we assess security and privacy in advance, not just price and features.

Vendor access to our systems is limited to what is needed, temporary where possible, and revoked afterwards.

Where to start

Common mistakes

Official sources

Read next