By [Author Name] · [Date] · [X] min read · [Table of Contents]
TL;DR
- A vendor compliance checklist is the short list of evidence you collect from a supplier so that you can answer somebody else's questions about them later.
- If no supplier touches your data or holds your devices, you don't need one and collecting documents will just fill a folder.
- It covers four domains: personal data, physical custody of devices, data destruction, and who else is involved.
- Three depths exist: a signed contract plus one agreement, an eight-item evidence pack, or a full assessment with a site visit.
- Collect the evidence that answers the question you'll actually be asked, which is almost never the one the template asks.
- Done right, a customer security questionnaire becomes an afternoon's work instead of a fortnight's chase.
The questionnaire has 94 questions and a section on subprocessors, and you get through the first 60 from memory and then reach the equipment ones. Who physically holds devices before they reach an employee. Where those devices are stored. How a departing employee's laptop is sanitised and who certifies it. You know the supplier's name. You don't have a single document, and the deal is waiting.
That is a specific and common bind, and it rarely reflects anything wrong with the supplier. The documents exist. They've just never been requested, because the purchase was made to solve a hiring problem and nobody involved was thinking about evidence. Eighteen months later the purchase is part of a control narrative somebody outside your company is assessing, and the narrative needs paper.
Best tools for HR Operations
So the real issue isn't compliance in the abstract. It's that the evidence is cheap to collect at the start and expensive under time pressure, and almost nobody collects it at the start. They don't know they'll need it. A checklist is the mechanism for shifting that work to the moment when it costs you an email. This is what a vendor compliance checklist is for.
When You Don't Actually Need a Compliance Checklist
When nobody touches anything. You buy hardware from a reseller, it ships to an office, and no supplier ever holds a device or sees an employee's address. There's nothing to evidence beyond the invoice. A checklist here produces a folder of documents that describe a relationship with no risk in it.
When the friction starts showing. The signal is a question you cannot answer without an email to the supplier. How long do they keep home addresses. Do they subcontract shipping in Brazil. Can they produce a wipe certificate. Each of those is a small delay, and three of them in a month means your supplier knowledge lives in their inbox rather than yours.
When it becomes a liability. Two triggers, and both come from outside. A customer questionnaire with a subprocessor section, or an auditor asking for evidence that leaver devices were sanitised by an accountable party. At that point the missing evidence is itself the finding, and you can't create a historical certificate after the event.
The edge case that breaks everything. A supplier relationship ending badly while they hold devices. If you have no contract on file, no inventory of what they hold and no exit terms, you are negotiating from a weak position about physical property. I'd rather have spent one hour on paperwork at the start than three weeks on that conversation.
What Teams Actually Need from the Evidence
> "Can I answer the subprocessor question?" > A list of who else touches the work, per market, that you hold rather than request. > This is the single most common equipment question in security reviews and the one teams are least prepared for.
> "Can I prove a leaver's device was wiped?" > A real certificate, naming devices by serial number, issued by an accountable party. > A status field someone set manually is not evidence, and the difference matters precisely when it is tested.
> "Do we have a data processing agreement, and does it cover what they do?" > A signed agreement whose scope matches the actual activity, including storage. > Plenty of agreements cover shipping and say nothing about holding devices for months, which is a different activity.
> "What are they insured for?" > A certificate with cover and limits for goods in transit and in storage. > This tells you what the supplier believes their own risk is, which is informative beyond the number itself.
> "What happens to the devices they hold if this ends?" > An exit clause naming who holds, who ships, who pays and how long it takes. > The cheapest clause to negotiate before signature and the most expensive thing to discover afterwards.
The Three Depths of Compliance Evidence
Contract plus one agreement. What it is: a signed contract with an exit clause, and a data processing agreement. Two documents, on file, with the renewal date recorded. When it's right: small suppliers, modest spend, nobody holding devices for long periods. This is the honest minimum for any supplier that has an employee's home address. When it fails: against a real questionnaire. Two documents will not answer a subprocessor question or produce wipe evidence, so you can expect to be back at the supplier's door when the first customer review arrives.
The eight-item evidence pack. What it is: the set below. Contract, data processing agreement, subprocessor list, example wipe certificate, insurance certificate, disposal and recycling evidence, a written coverage statement per market, and a named escalation route. When it's right: this is the right default for any company whose suppliers hold devices or ship to homes. It takes a day of your time spread over three weeks of waiting, and it answers almost every question you will later be asked. When it fails: when it becomes a filing exercise. A pack assembled once and never refreshed goes stale in about a year, mostly because insurance certificates expire and subprocessor lists change.
Full assessment. What it is: all of the above plus security questionnaire responses, penetration test summaries, financial information and sometimes a warehouse visit. When it's right: regulated sectors, large contract values, or arrangements where a supplier holds devices containing customer data at rest. When it fails: when applied to a supplier who cannot resource it. You will either be refused or handed documents assembled for the test, and a good small supplier may simply decline to bid. Match depth to consequence rather than to ambition.
How to Choose a Depth: Five Questions Before You Start
What will you actually be asked? Work backwards from the questionnaire rather than forwards from a template. If your customers send security reviews, get hold of one and read the supply chain section, because that tells you exactly which evidence has value for you. Collecting documents nobody will ever ask about is the most common way this work becomes a ritual.
Does the supplier hold devices, or only move them? This is the dividing line that matters most. A courier that moves a sealed box has a narrow risk profile. A supplier holding 40 of your laptops in a warehouse for an average of eleven weeks has a different one, and the evidence you need from each is not the same. Ask about average dwell time in storage, which nobody volunteers and which changes the assessment.
Where does personal data go? Shipping to a home address means a name and an address at minimum, and sometimes a phone number. Find out what the supplier keeps, for how long, and whether any of it crosses a border in the process. Then take that to your own advisers rather than to an article, because the obligations differ by jurisdiction and by the specifics of the arrangement.
Who else is involved? Almost every logistics supplier partners in some markets, and that is normal rather than concerning. What matters is whether they will tell you. A supplier who presents partnered coverage as owned coverage has made a choice about awkward facts, and that choice will reappear in an incident report later.
Who keeps this current? Evidence decays. Insurance certificates expire, subprocessor lists change, contacts leave. Name an owner and a review cadence, which is twenty minutes a quarter, and the pack stays usable. Without an owner you will have a folder of documents that were true once, which is slightly worse than nothing because it invites false confidence.
The Eight Items, and What Each One Actually Proves
This is the core of the article. For each item: what to ask for, what it proves, and what a weak response looks like.
1. The signed contract, with the exit clause. Ask for the executed copy, not the template. It proves the commercial relationship exists on terms somebody agreed, and the exit clause tells you whether leaving was ever thought about. A weak response is a template with blanks, or a contract nobody can locate, which happens more often than you'd expect when the original signer has left.
2. Data processing agreement. It proves the supplier has been asked about data handling before and has a position. The scope is the part to read: check that it covers storage and retrieval rather than only shipping, since those are different activities with different data. A weak response is an agreement whose activity description does not match what the supplier actually does for you.
3. Subprocessor or partner list, per market. This proves who else touches the work, and it is the item most likely to be requested by a customer's security team. A weak response is a global country count offered in place of a per-market answer. Ask for your markets specifically, and mark each as direct or partnered.
4. An example wipe or sanitisation certificate. Request a real one with the customer details removed. It proves that evidence is a routine output rather than an exception process, which is the thing you actually need to know. A weak response is a promise to provide one on request, or a document that arrives three weeks later looking freshly made.
5. Insurance certificate for goods in transit and in storage. It proves cover exists and shows you the limits, which tells you what the supplier believes their risk to be. A weak response is cover for transit only when the supplier also stores, which is a gap worth asking about rather than assuming.
6. Disposal and recycling evidence. If the supplier disposes of end-of-life hardware, ask what standard they work to and who the downstream processor is, and it proves the disposal chain has a named end rather than fading out. A weak response is an assurance about environmental responsibility with no processor named and no certificate.
7. A written coverage statement, per market. Not a map. A table with your markets, stating direct or partnered, the delivery window, whether retrieval is available and who acts as importer of record. This proves capability where you need it, and it is the single most useful artefact in the pack for operational purposes as well as compliance.
8. A named escalation route. A person or a role, per region, with a stated response time and a second line above them. It proves there is a path when something goes wrong. A weak response is a support email address, which is fine for routine matters and useless at the moment you need it.
| Item | What to ask for | What a weak response looks like |
|---|---|---|
| Signed contract with exit clause | The executed copy | A template with blanks |
| Data processing agreement | Signed, with activity scope | Scope that omits storage |
| Subprocessor list per market | Your markets, direct or partnered | A global country count |
| Example wipe certificate | A real one, details removed | A promise to provide on request |
| Insurance certificate | Transit and storage, with limits | Transit only, when they also store |
| Disposal evidence | Standard and downstream processor | An environmental assurance, unnamed |
| Coverage statement per market | A table, not a map | A total, with no per-market detail |
| Named escalation route | Role, response time, second line | A support inbox |
What a Small Supplier Will Not Have, and Why That Is Fine
Being fair about this is part of doing it properly, because an unreasonable checklist eliminates good suppliers and keeps bad ones with better document teams.
Some items reflect scale rather than practice. That isn't the same thing. A penetration test summary, a formal information security certification, audited accounts: a fifteen-person supplier may genuinely have none of these, and their absence tells you about the company's size rather than about how it handles your devices. Those are the items to treat as informative rather than disqualifying.
Other items reflect practice, and their absence matters a great deal more. An example wipe certificate. A subprocessor list. An exit clause. A supplier doing this work properly generates all three as a matter of routine, so a supplier who cannot produce them is telling you something about how the work is actually done rather than about their headcount.
So split the list in two. Do it before you send anything. Mark the practice items as required and the scale items as informational, and say so in the covering note, and that single piece of framing improves the quality of responses noticeably, because a small supplier reading a list of enterprise requirements often assumes it can't win and answers accordingly.
One more fairness point. Give a deadline and make it reasonable, which means two weeks rather than three days. Suppliers are assembling documents from several internal sources, and a short deadline selects for companies with a compliance function rather than for companies that do the job well. In my experience the response time tells you much more about their internal organisation than about their willingness, so read a slow but complete response more generously than a fast and partial one.
The Questions You Will Actually Be Asked, Mapped to the Evidence
Work backwards. Here is the mapping between the questions that appear in real security reviews and the items above, because this is what makes the pack worth assembling rather than a precaution.
| Question you will be asked | Item that answers it | How long it takes with the pack |
|---|---|---|
| Who are your subprocessors for device logistics? | Subprocessor list per market | Two minutes |
| How is employee personal data handled by suppliers? | Data processing agreement | Two minutes |
| How do you ensure departing employees' devices are sanitised? | Example wipe certificate, plus your process | Ten minutes |
| Where is company hardware stored when not in use? | Coverage statement, plus the storage answer | Five minutes |
| What happens to end-of-life hardware? | Disposal evidence | Five minutes |
| What is your supplier's incident escalation? | Named escalation route | Two minutes |
| Is hardware insured in transit? | Insurance certificate | Two minutes |
| What happens if the supplier relationship ends? | Exit clause | Five minutes |
Without the pack, each of those rows is an email to a supplier and a wait of one to five working days, which is how a single questionnaire turns into a fortnight. With it, the whole section is an afternoon. That arithmetic is the entire business case for doing this at the start, and it is worth putting in front of anybody who thinks the exercise is bureaucratic.
Your Own Side of the Checklist
Half of every supply chain question is about the supplier and half is about you, and the second half is the part teams forget to prepare. A customer asking how departing employees' devices are sanitised is asking about your process as much as about your supplier's capability.
So write down your own four answers alongside the supplier's documents, because these are the ones you will be asked to describe rather than to evidence.
What triggers a collection, and when. Name the system event and say how many days before the last working day it fires. This is the answer that most impresses a security reviewer, because it demonstrates that recovery is a process rather than a hope. If the honest answer is that somebody sends an email when they remember, say that internally and fix it, since it is the cheapest improvement available and it will be asked about.
What proportion of devices come back, and in what time. A measured figure, even an imperfect one. Reviewers do not expect perfection and they react well to a stated number with a stated method, which is the same principle that applies to asset register accuracy. A company that knows its recovery rate is visibly in control of its fleet, and one that does not know is visibly not.
Who holds the inventory, and how accurate is it. Name the system and give a sampled accuracy figure. Twenty-five rows, physically confirmed, quarterly. This is a tiny piece of work that converts an unanswerable question into a short factual answer, and it is the single most useful habit in this whole area.
What happens to devices you cannot recover. There will be some. The good answer describes a policy: a status for unaccounted devices, a period after which they are written off, and a record of the decision. The poor answer is silence, because silence implies either that nothing ever goes missing or that nobody is counting, and a reviewer will assume the second.
Those four answers take an afternoon to assemble the first time and fifteen minutes a quarter to maintain. Put them in the same folder as the supplier documents, because the question that arrives will not respect the boundary between your process and your supplier's, and having both halves in one place is what turns a fortnight of chasing into an afternoon of copying.
Where the Suppliers Actually Stand
Worth knowing before you send anything, because the commercial posture in this category affects how your requests land.
I read the pricing pages of the main equipment logistics suppliers on 28 October 2026, and almost none publishes a rate card. Workwize publishes nothing. Firstbase publishes nothing. GroWrk publishes nothing and leans on a modelled cost estimator. allwhere is consultation-only. Deel IT publishes no IT rate card. Esevel is quote-based across three named tiers.
RemoAsset is the exception, publishing $1,499 a year for its Subscription tier, with procurement and retrieval stated across 80+ countries and a 60% reduction on retrieval charges at that tier. Disclosure: RemoAsset is our own product, so its limits belong in the same paragraph as its figure. It does no network discovery, so it will not find hardware you forgot you owned. It does no software licence management. And only the Subscription tier publishes a figure, because the pay-as-you-go side is quoted.
Why does that matter here? A supplier running an enterprise sales motion will route your document request through a sales contact, which adds a week and a layer of filtering. A supplier with self-service pricing more often has a support route that will send you a document directly. Neither is better, and knowing which you are dealing with lets you set a realistic timeline rather than chasing somebody who was never going to answer quickly.
On the asset management side the picture is similar and the practical point is different. Lansweeper and Asset Panda publish no rate card, Device42 publishes nothing readable, and both Oomnitza and Ivanti have no pricing page at all. ManageEngine does publish, across three products on three different units. For a compliance pack this matters less. Because asset platforms hold data rather than devices, so your evidence focus shifts almost entirely to the data processing agreement and away from physical custody.
The Email That Collects All Eight Items
The practical obstacle is rarely willingness. It's that writing the request feels like a task, so it gets deferred, and then it gets written under pressure in a way that produces a slow reply. Here is the shape that works, and it takes about ten minutes.
Open with context in one sentence: you are completing a supplier review and would like a small set of documents. Then list the items as bullets, numbered, each one specific. Then give a date, two weeks out. Then say what you will do with them, which is hold them on file for customer security reviews. That last line matters more than it looks, because a supplier who understands the purpose sends the right document rather than the nearest one.
Three details change the response rate. First, split the list visibly into required and optional, and mark the four practice items as required. Suppliers triage, and an unsegmented list of eight gets triaged by whoever opens it rather than by you. Second, ask for the wipe certificate as a redacted real example rather than as a specimen, because the word specimen invites a template and the word redacted invites the real thing. Third, send it to the account contact and ask them to route it, rather than trying to find a compliance address yourself. You will get there faster through the person who wants to keep your business.
What to do when the reply is partial, which it usually is. Accept it, file what arrived, and reply once with the gaps listed and a new date. Do not re-send the whole list. Because that reads as a reset and starts the triage again. Two rounds is normal and three means somebody has lost the thread, at which point a five-minute call closes it faster than a fourth email.
And keep a one-line record of what you asked for, when, and what came back. In eighteen months the useful artefact is not just the documents but the evidence that you asked, because a supplier review that happened and produced a partial result is a defensible position, while no review at all is not.
Handling the Items You Cannot Get
Some requests fail, and the way you record that failure is the difference between a gap and a finding.
Write it down. If a supplier genuinely cannot produce an item, record what you asked for, what they said and what you decided to do about it. That is a risk acceptance, and it is a normal and respectable thing for a company to have. An auditor reading "we requested a penetration test summary, the supplier does not hold one given its size, and we accepted this on the basis that no customer data is processed" is looking at a controlled position. An auditor finding nothing at all is looking at an absence.
Then decide whether the gap needs a compensating measure. Most don't. Where one is warranted, the useful ones are small: a shorter notice period in the contract, a cap on how many devices the supplier may hold at once, or a requirement to notify you of subprocessor changes in writing. Each of those is a single clause and each converts an evidence gap into a managed risk.
The one gap I would not accept quietly is the exit clause. Everything else can be worked around. But an arrangement where a supplier holds your physical property on terms that do not say what happens at the end is the one that can cost real money and real time. If a supplier will not put exit terms in writing, that is worth escalating internally before signature rather than noting in a folder, and it is a reasonable thing to lose a deal over from your side.
What Changes When a Supplier Also Disposes of Hardware
One domain deserves extra attention because it sits at the end of the lifecycle and gets the least scrutiny during an evaluation. If your supplier also handles disposal, you have extended the relationship past the point where you can see it.
The chain has three links and most contracts describe one. The supplier collects the device. Somebody sanitises it. Somebody else recycles or resells the physical hardware, and that third party is frequently not the supplier you contracted with. Which means the question that matters is who the downstream processor is, and whether the supplier will name them. A supplier who names the processor and can produce a certificate from them has a chain you can describe to an auditor. A supplier who speaks about responsible recycling without naming anybody has a chain that ends in a fog.
Two specific things to ask for, and both are reasonable requests. First, the standard the sanitisation is performed to, stated as a name rather than as an adjective. Second, whether the certificate you receive covers the wipe only or the physical disposal as well, since those are sometimes issued by different parties and a buyer frequently assumes one document covers both.
And one thing to decide on your own side. What proportion of end-of-life hardware do you want resold rather than recycled, and who receives the proceeds. This is a commercial question dressed as a compliance one, and the answer affects the evidence you need: a resale route means a device leaves your control and enters somebody else's possession as working hardware, which is a different assurance requirement from a device that was shredded. Neither is harder. They just want different paperwork, and knowing which route you are on before you sign saves a conversation later.
The Decision Table: How Much Evidence to Collect
| Situation | Scale / Size | Setup | Primary Pain | Recommended Starting Point |
|---|---|---|---|---|
| Reseller only, nobody holds anything | Any | In-office | None | Keep the invoice and the quote |
| Supplier ships to home addresses | 30 to 150 people | Distributed | Personal data, modestly | Contract plus a data processing agreement |
| Supplier stores devices between users | 50 to 500 people | Distributed | Physical custody | The eight-item pack |
| Customer questionnaires arriving | 100 to 600 people | Any | Evidence lives in people's heads | The eight-item pack, prioritise subprocessors |
| Devices hold regulated customer data | Any | Any | Audit exposure | Full assessment, including disposal chain |
| Supplier is a small specialist | Any | Any | They lack enterprise documents | Practice items required, scale items optional |
| Replacing a supplier that failed | Any | Any | Burned once | Exit clause and warehouse inventory first |
Most teams need the third or fourth row. The two most commonly skipped items, in both, are the example wipe certificate and the per-market coverage statement, and they are the two that do the most work later.
The Four Domains, and What Each One Is Really Asking
The eight items are the artefacts. Underneath them sit four domains, and understanding the domains is what lets you answer a question the checklist did not anticipate.
Personal data. The question behind every question here is: whose data, held by whom, for how long, and where. Shipping to a home address puts a name and an address into a supplier's system, and sometimes a phone number so a courier can call. That is a small dataset with a clear purpose, which is why this domain is usually the easiest to satisfy. The two things to pin down are retention, meaning how long they keep an address after a delivery, and onward transfer, meaning whether a courier in another country receives it. Both answers come from the supplier. What those answers mean for your obligations is a question for your own advisers, and it differs by jurisdiction in ways that no article can usefully summarise.
Physical custody. This domain is specific to equipment and is where most general compliance templates are useless, because they were written for software suppliers. The questions are concrete. Who physically holds a device, in which building, for how long on average, with what access controls, and what happens if it is damaged or lost while they hold it. Average dwell time in storage is the number nobody volunteers and the one that changes the risk picture most, because a supplier holding devices for two days is doing something different from one holding them for eleven weeks.
Data destruction. The question is not whether a device is wiped. It is whether anybody can later prove it was, and by whom. So the useful evidence is a certificate that names devices by serial number, states the method or standard applied, carries a date and identifies an accountable party. Anything short of that is an assertion. The common gap is a supplier who genuinely does wipe devices properly and generates no durable record of having done so, which is a documentation problem rather than a security one and is usually fixable by asking.
Who else is involved. The subprocessor question, and the one most likely to be asked by a customer. Almost every logistics supplier partners somewhere, which is normal. What you need is the list, per market, and a commitment to tell you when it changes. The commitment matters as much as the list, because a list is a snapshot and your customer's question next year will be about the current state.
| Domain | The real question | The evidence that answers it | What is usually missing |
|---|---|---|---|
| Personal data | Whose, held by whom, how long, where | Data processing agreement with scope | Retention period for addresses |
| Physical custody | Who holds it, where, for how long | Coverage statement plus storage answer | Average dwell time in storage |
| Data destruction | Can anybody prove it was wiped | Certificate with serials, method, date, party | A durable record, not the wipe itself |
| Who else is involved | Which markets are partnered | Subprocessor list, per market | A commitment to notify on change |
There's one practical benefit, and it's worth the ten minutes. When a customer sends a question you have not seen before, you can place it in a domain and know immediately which document answers it, or know that you have a genuine gap. Working from the item list alone leaves you matching keywords, which is how a question that you could have answered gets escalated to the supplier unnecessarily.
The Cost of Skipping This
The costs here are mostly measured in calendar time and credibility rather than in money, which is why they get deprioritised and why that is a mistake.
The first cost is a delayed deal. A customer's security review stalls on a supply chain section, you go to the supplier for documents, and the response takes a week because it has to pass through a sales contact. Meanwhile the deal sits. Nobody records this as a cost of not having a compliance pack, but it's one, and it recurs with every new enterprise customer.
The second is the condition that gets added. When you cannot answer a question, a customer's security team will often accept the gap and write a requirement into the contract instead: quarterly evidence, annual attestation, notification of subprocessor changes. I've seen that become a recurring obligation consuming a day every quarter for years, all of it downstream of one unanswerable question.
The third is positional. It's where you stand if a supplier relationship ends badly. Without a contract on file, an inventory of what they hold and an exit clause, you are discussing physical property with no agreed basis. That conversation is unpleasant, slow and occasionally expensive, and the preventive measure was an hour of document collection at the start.
So the diagnostic worth sitting with: are you collecting evidence to assess a supplier, to answer somebody else's questions, or to protect a position if things go wrong? All three are legitimate and they want slightly different items, and knowing which one you are doing stops the checklist from growing without limit.
When You're Ready to Move Beyond a Folder of Invoices
The signals are specific. A customer has asked about your supply chain in writing. A supplier holds devices you cannot count. You have an equipment supplier whose contract nobody can locate, and somebody has asked for wipe evidence and the answer was a conversation rather than a document. Any two of those and the invoice folder has stopped being adequate.
Start with four, not eight. The exit clause, the data processing agreement, the subprocessor list and one example wipe certificate, and those four answer most of what you'll be asked, and they can be requested in a single email today. The other four are worth having and none of them is urgent.
RemoAsset publishes an annual figure for its Subscription tier and carries the three limits named above, and for a compliance pack the useful property of any supplier is not its price but whether it answers a document request in writing within two weeks. That is the test worth running on every candidate, including this one.
Frequently Asked Questions
What is a vendor compliance checklist?
It's a short list of evidence. You collect it from a supplier so that you can answer somebody else's questions about them later without having to go back and ask. For equipment suppliers the useful set is eight items, covering the contract, data handling, who else is involved, proof of sanitisation, insurance, disposal, per-market coverage and an escalation route. The purpose is to shift the collection work to a moment when it costs an email rather than a deal delay.
Which compliance documents matter most for an equipment supplier?
Four do most of the work. The exit clause in the signed contract, the data processing agreement, the subprocessor list broken down by your own markets, and a real example of a wipe certificate. Those four answer the majority of questions that appear in customer security reviews, and all four can be requested in one email.
What if a small supplier does not have these documents?
Split the list in two. Practice items and scale items get judged differently. A penetration test summary or a formal certification reflects company size, and a small supplier may legitimately have neither. An example wipe certificate, a subprocessor list and an exit clause reflect how the work is actually done, so their absence is a much more meaningful signal.
How often should we refresh the evidence?
Twenty minutes a quarter, and once a year properly. The quarterly check confirms the renewal date, notes any market where service failed and files any new certificate. The annual pass re-requests the insurance certificate and the subprocessor list, since those are the two items most likely to have changed without anybody telling you.
Do we need a data processing agreement with a company that just ships laptops?
Almost certainly. Shipping to somebody's home requires their name and address, and that's personal data under most regimes. What the agreement needs to say, and what else applies, depends on your jurisdiction and on the specifics of the arrangement, so take that to your own advisers rather than to a template. The practical signal is that a supplier with a standard agreement ready has been asked before.
What is the difference between this and vendor due diligence?
They differ in purpose. Due diligence is the broader assessment of whether a supplier can do the job and will still be in this line of work in three years, while a compliance checklist is the narrower exercise of collecting evidence you can show to somebody else. They overlap heavily and the documents are mostly the same. But the purpose differs, and that changes which items you treat as essential.
Can we collect this evidence after we have already signed?
Yes. Most teams end up doing exactly that, so it's worth saying plainly that collecting the evidence late still works. The only item you genuinely cannot create retrospectively is historical wipe evidence for devices already disposed of, which is a gap to note honestly rather than to paper over. Everything else can be requested from an existing supplier, and a reasonable supplier will provide it.
One last point on timing, since it is the only part of this that cannot be recovered later. Every item on the list can be requested from a supplier you have already signed with, and most suppliers will provide them without complaint. The exception is historical wipe evidence for devices that have already been disposed of, which simply does not exist if nobody generated it at the time. That is the one gap you cannot close retrospectively, and it is the argument for asking for the example certificate in the first month of a relationship rather than the first month of an audit. Everything else on the list is recoverable. That one is not.
Collect four documents today, while it costs you one email instead of a deal.
