TL;DR
- An equipment vendor is a data processor that nobody classifies as one. They hold home addresses, phone numbers and a map of who works where, which is a more sensitive dataset than most people realise.
- They also physically touch every device before it reaches your staff. That is a supply chain position, and the standard software security questionnaire has no question about it.
- The generic questionnaire will pass them and miss the things that matter here. It asks about data centres and encryption at rest, and says nothing about who handles the laptop or what the warehouse staff can see.
- Subprocessors are the real surface. Vendors in this category operate through local partners in most markets, and the question is what those partners receive about your employees.
- Device disposal is where the sharpest question sits. If the vendor wipes machines, ask what standard, what evidence and what happens to drives that fail to wipe.
- Run the review before the pilot, not after. A vendor who cannot answer these in a first call is telling you something, and finding that out costs one meeting.
The vendor who passed the questionnaire and failed the question
A 500-person company ran a proper procurement process for an equipment platform. Security was involved, the vendor completed a standard questionnaire covering encryption, access control, certifications and incident response, and the answers were good. Everything cleared.
Four months in, somebody in the security team asked a question that had not appeared anywhere in the process. When a laptop is delivered to an employee in a market where the vendor uses a local partner, what does that partner receive?
The answer, which nobody had asked for and the vendor supplied readily, was: the employee's full name, home address, phone number, and the delivery instruction. Across eleven markets, that meant eleven third parties held a current list of where a portion of the company's staff lived.
Best tools for HR Operations
Nothing had gone wrong. The vendor was not doing anything improper and the arrangement is how this industry works. But the company had a data processing relationship it had never assessed, with subprocessors it had never named, covering a dataset it would have treated carefully in any other context. The questionnaire had asked about encryption at rest in the vendor's data centre and nothing at all about the eleven couriers.
When a light-touch review is genuinely enough
You are using them for one market and they handle it directly. A domestic arrangement with no partner network has a much smaller surface. The data questions still apply, the subprocessor questions mostly do not.
They never see employee personal data. Some arrangements ship in bulk to an office and your team distributes. If the vendor receives a quantity and a company address and nothing else, most of this article is not your situation.
The devices are not enrolled or configured by them. If machines arrive sealed and your team does everything, the supply chain question narrows considerably. You still care about disposal, and you care less about everything in between.
It is a short pilot with no production data. Reviewing a ninety-day trial to the same depth as a three-year commitment is not proportionate. Run a lighter version, and run the full review before the commitment rather than before the trial. The caveat is that a pilot involving real employees is not a pilot without production data, since the addresses are real whether or not the contract is, so check what the trial actually involves before deciding it is low risk.
Why the standard questionnaire misses this category
Most security questionnaires were designed for software vendors, and an equipment vendor is a logistics company with a software product attached. The questions therefore land in the wrong place.
The questionnaire asks where data is hosted and how it is encrypted. Those are reasonable questions and the answers are usually fine, because the platform component is built like any other SaaS product.
What it does not ask is who physically handles the device, what they can see about the person it is going to, which third parties receive employee data in order to complete a delivery, what happens to a machine between one holder and the next, and what evidence exists that a drive was actually wiped rather than reported as wiped.
Those five questions are where the real risk sits, and a vendor can answer an entire standard questionnaire without touching any of them. That is not evasion. It is a form built for a different kind of supplier.
So the practical approach is to run the standard questionnaire, because it covers the platform properly, and then add a short supplementary set covering the physical and subprocessor dimensions. The supplement is usually a page and it is the part that produces the useful answers.
Certifications, and what they do and do not tell you
Most vendors in this category will lead with a certification, and the useful skill is reading what one covers rather than treating its presence as the answer.
Check the scope statement, not the badge. Certifications are granted against a defined scope, and that scope is frequently the platform and the corporate environment rather than the warehouse, the configuration process or the partner network. A certificate covering a software product tells you something real about that software product and very little about who picks and packs the laptop.
Check the date and the period covered. An attestation covering a period that ended fourteen months ago describes a company that may have changed considerably, particularly one growing into new markets through new partners.
Check whether subprocessors are in scope. They usually are not. A vendor can hold a strong certification covering its own operations while the eleven partners handling deliveries in your markets sit entirely outside it.
And ask what was excluded. Every scope statement has exclusions and they are the informative part. A vendor who can describe their exclusions without defensiveness has engaged with their own certification; one who has not read it will be vague.
None of this is an argument against certifications. They are genuine evidence of a functioning programme and a vendor who holds none is a different proposition. The point is narrower: a certification answers questions about the certified scope, and the questions in this article are largely about what sits outside it.
The data they actually hold
Start by being precise about this, because most companies have not enumerated it.
To deliver a device to an employee, a vendor needs that person's name, home address and usually a phone number for the courier. To retrieve one, they need the same plus some way of contacting somebody who may have just left your company. To support an enrolled device, they may hold identifiers that link a machine to a person.
Aggregated across your workforce, that is a current list of where your employees live, which is more sensitive than any single record suggests. It is also a dataset that changes constantly and that very few companies have thought about as a dataset at all, because it arrives one delivery at a time.
Three questions worth asking directly. What do you hold, field by field? Ask for the list rather than a description. How long do you keep it after a delivery completes? Indefinite retention of home addresses for former employees is common and rarely intentional. What happens to it when we leave? Deletion on termination should be contractual and specific rather than assumed.
| Data | Why they need it | Question to ask |
|---|---|---|
| Name and home address | Delivery and collection | Retention period after completion |
| Phone number | Courier contact | Is it passed to the partner or held centrally |
| Employment status | Triggering a retrieval | How do they learn somebody left, and from whom |
| Device to person link | Support and asset tracking | Who can see it internally and is access logged |
| Historical addresses | Usually nothing | Why is it still there |
Subprocessors, which is where the surface actually is
Almost every vendor in this category operates through partners in some markets. That is not a weakness, it is how global coverage is achieved without owning operations in eighty countries, and a vendor claiming otherwise is worth a second look.
What matters is whether you know who they are and what they receive.
Ask for the list by market. Which countries are served by the vendor's own operation and which by a partner, named. Vendors will usually provide this and the ones who hesitate are telling you something useful.
Ask what the partner receives. Frequently the full delivery record including the employee's name, address and phone number. Sometimes a reference number and a collection point. The difference matters a great deal and it varies by vendor and by market.
Ask what obligations flow down. Whether the vendor's contracts with partners impose the same data handling requirements they are accepting from you, and whether anybody checks. A clause that exists on paper and is never audited is weaker than it looks, and a vendor who says so honestly is more reassuring than one who claims perfect oversight of thirty partners.
And ask about change. Partner networks shift. Whether you are notified when a market changes hands is a question worth having an answer to before it happens.
The physical chain, which no software questionnaire covers
Between the manufacturer and your employee, a device is handled by people. That is a supply chain position and it deserves proportionate questions.
Who has physical access before it ships? Warehouse staff, configuration technicians, whoever picks and packs. Ask whether those roles are background-checked and whether access to the staging area is controlled.
What is done to the device? If the vendor images, enrols or configures machines, they are installing software on hardware you will trust. Ask what the build is, where it comes from, and how they know it has not been altered.
What happens to a device between holders? A machine returned by one employee and issued to another passes through a process. Ask what inspection and wipe happens, who performs it and what is recorded.
And what happens to a device that fails? A faulty machine goes somewhere for repair, which may be a fourth party nobody has mentioned, and it may still hold data. This is the most commonly overlooked path in the whole chain, because repair feels like a maintenance question rather than a data one. Ask specifically whether repairs are performed in-house or sent out, whether drives are removed first, and what happens to a machine that is written off at the repair stage rather than returned.
None of this requires a deep audit for most companies. It requires asking, and the quality of the answer tells you most of what you need. A vendor who has thought about it will answer specifically. A vendor who has not will answer in generalities, and that is itself the finding.
Disposal and wiping, where the sharpest question sits
If the vendor handles end-of-life devices, this is the area to press hardest, because it is where an unverified claim does the most damage.
What standard? Ask them to name it, specifically and in writing, rather than accepting a general statement that devices are securely wiped. The answer should be a specific method appropriate to the drive type, and modern solid state drives behave differently from older spinning disks in ways that matter.
What evidence? A report per device, with serial numbers, is the thing to ask for. A general assurance that wiping occurs is not evidence and will not help you during a certification audit.
What happens when a wipe fails? This is the question that separates vendors. Drives do fail to wipe, and the correct answer involves physical destruction with a certificate rather than a retry and a shrug. Ask what their rate is and what the process is, and be more comfortable with a vendor who admits a nonzero failure rate than one who implies it never happens.
And are they certified for this? Many equipment vendors wipe devices without being a certified IT asset disposition provider, which is a meaningful distinction if your compliance position requires formal destruction certificates. It does not make them unsuitable. It means disposal may need a separate arrangement, and you should know that before you assume it is covered.
RemoAsset is our own product and this is the disclosure rather than a footnote. It covers procurement and retrieval across 80+ countries and publishes a Subscription tier from $1,499 a year. On this specific topic the limits matter more than usual and we would rather state them than have you discover them in a review: it enrols devices but is not an MDM in its own right, so endpoint policy enforcement remains your separate arrangement; it wipes devices but is not a certified ITAD, so if your position requires formal destruction certificates that is a separate provider; and coverage and lead times vary by market, which in this context means the subprocessor questions above apply to us as much as to anybody.
The contract, and the clauses worth having
What you agree matters more than what you were told on a call, because the call is not what anybody refers to eighteen months later. Terms vary by jurisdiction and circumstance, so take your own advice on what is appropriate for you, but these are the areas worth having a position on rather than accepting whatever is in the template.
| Area | What to look for | Why it matters here |
|---|---|---|
| Data processing terms | A specific agreement rather than a clause | Equipment vendors are often not offered one by default |
| Subprocessor list | Named, with notification of change | The partner network is the real surface and it shifts |
| Breach notification | A stated window and a named route | Default terms are often vague or absent |
| Audit or evidence rights | At minimum the right to request reports | A right to audit you will never exercise is still worth having |
| Retention and deletion | Specific periods, deletion on termination | Indefinite retention of home addresses is common by default |
| Disposal evidence | Per-device reports as a deliverable | Turns an assurance into an obligation |
| Flow-down to partners | Same obligations imposed downstream | Otherwise your terms stop at the vendor |
Two practical notes. Ask for the data processing agreement rather than waiting to be offered one, because vendors whose primary self-image is logistics frequently do not lead with it. And get the disposal evidence written in as a deliverable rather than a practice, since that is the difference between something you can produce during an audit and something you have to request and hope for.
Incident response, and the question nobody asks
Every vendor has had an incident. The useful question is not whether, but what happened afterwards and how you would find out.
How would we learn? Ask for the specific route. An email to a named address, a portal notification, a call to your account contact. Then ask who at your company that reaches, because a notification sent to somebody who left is the same as no notification.
Within what window? A stated period is worth having even if it is longer than you would like, because the alternative is discovering it from somewhere else.
What counts as an incident worth telling us about? This is where the definitions matter. A breach of the vendor's platform is obvious. Less obvious: a partner in one market losing a delivery manifest, a warehouse theft, a device going missing in transit with your data on it. Ask explicitly whether those reach you.
And what happened last time? Everybody has a last time. A vendor who describes one specifically, says what changed and does not oversell the response is considerably more reassuring than one who implies a clean history. The detail in the answer is the finding, as with most questions in this article.
One thing worth deciding on your own side: who owns this relationship when something goes wrong. Equipment vendors sit between IT, HR and procurement, and an incident notification that arrives with no obvious owner tends to sit for a day while people work out whose it is.
Internal access at the vendor, which is usually weaker than external
Most questionnaires assess the perimeter. The more realistic exposure is who inside the vendor can see your data and whether anybody would know if they did.
Who can see employee addresses? Support staff, warehouse operators, account teams. Ask whether access is role-based or whether most of the company can query the delivery system, which is more common than you would expect at smaller vendors.
Is access logged, and does anybody look? Logging without review is a record nobody reads. Ask whether access to customer data generates an audit trail and whether that trail is monitored or only consulted after an event.
What happens when their staff leave? Vendor offboarding is your exposure too. A departed warehouse manager with retained access to a delivery system holding your employee addresses is a risk you have no visibility of.
And can they export? The ability of an individual to pull a full customer dataset to a spreadsheet is the single most common path to an avoidable incident. Ask whether bulk export is restricted and to whom.
These questions are mildly uncomfortable to ask and vendors generally answer them straightforwardly. A vendor who bristles is giving you information; a vendor who says their controls here are weaker than they would like and explains what they are doing about it is giving you better information than one who claims everything is locked down.
If the vendor fails the review
This is the part most articles skip, which leaves you with findings and no path.
Separate fatal from fixable. Most findings are fixable: no data processing agreement, no subprocessor list, no per-device wipe evidence. Those are things a vendor can provide or commit to, and the review has done its job by surfacing them. Fatal findings are narrower: an inability to say which third parties hold your employee data, or disposal claims that cannot be evidenced at all while you are telling auditors otherwise.
Put fixable findings in the contract with dates. A commitment to provide something by a date is worth considerably more than a verbal assurance, and vendors generally accept this because the alternative is losing the deal.
Be proportionate about the pilot. A finding that would block a three-year commitment does not necessarily block a ninety-day trial with a limited cohort, provided you know what the exposure is and have bounded it.
And weigh the alternative honestly. If the realistic alternative to an imperfect vendor is your current arrangement, which may be a spreadsheet and a courier account with no assessment at all, the vendor with known gaps may be the stronger position. Reviews exist to inform decisions rather than to produce refusals, and a review that only ever says no stops being consulted.
The questions that actually produce answers
A questionnaire gets completed by somebody whose job is completing questionnaires. A call gets answered by somebody who knows. Ask these on a call.
Walk me through what happens to a laptop from your warehouse to my employee in your hardest market. Open ended, and the detail in the answer tells you how well they know their own operation.
Which of your markets are partner-served and what do those partners receive about my people? Specific, and the one that found the problem in the story above.
Show me a wipe report. Redacted is fine. A vendor who can produce one quickly has a process; a vendor who needs a week does not. The speed of the answer is most of the signal here, because a per-device report is either something their system emits routinely or something somebody has to construct for you, and only the first of those will still be happening in two years.
What was your last security incident and what changed afterwards? Everybody has had one. A vendor who says they have not is either new or not telling you, and the answer to the second half is more informative than the first.
Who at your company can see my employee addresses, and is that access logged? Internal access control is frequently weaker than external, and this question is rarely asked.
Ask all five in one sitting rather than spreading them across an exchange of emails. The point of the format is that follow-up questions are possible, and the follow-up is usually where the useful detail appears. A vendor describing their hardest market will mention the partner arrangement unprompted; the same vendor completing a form will answer the question as written.
The decision table
| Situation | Scale | Setup | Primary Pain | Recommended Starting Point |
|---|---|---|---|---|
| Single market, vendor delivers directly | Under 100 | No partner network | Minimal surface | Standard questionnaire plus disposal questions |
| Multi-market with partners | 100 to 500 | Several countries, mixed coverage | Unassessed subprocessors | Get the partner list by market first |
| Regulated sector or certification in scope | Any | Audit evidence required | Wipe evidence and chain of custody | Lead with disposal, ask for a sample report |
| Vendor configures and enrols devices | Any | They build the image | Supply chain integrity | Ask what the build is and how it is verified |
| Short pilot | Any | No production data yet | Proportionality | Light review now, full review before commitment |
| Existing vendor, never reviewed | Any | Live for months or years | Nobody knows what was agreed | Start with the data inventory question |
The retrieval problem, which is the hardest one in this category
Delivery involves somebody who works for you. Retrieval involves somebody who does not, and that changes the data question in a way nobody anticipates.
To collect a device from a leaver, the vendor needs to contact a former employee at a personal address, often weeks after they stopped working for you. That means your vendor holds and uses personal data about people who have no relationship with your company at all, for a purpose those people may not have been told about clearly.
Three things follow and they are worth settling explicitly.
How does the vendor learn somebody has left? Usually from an HR integration or a manual trigger. Either way, employment status is flowing to a third party, and the timing of that flow determines how long a departed person's record sits in the vendor's active system.
What are leavers told? Most companies tell departing employees that equipment will be collected and almost none say by whom, or that their address and phone number will be passed to a logistics partner for that purpose. That is a small gap and it is the kind of thing that becomes awkward when somebody asks.
And what happens when collection fails? A leaver who does not respond stays in the vendor's system, potentially indefinitely, with contact attempts continuing. Ask what the stopping rule is, both for the contact attempts and for the data retention afterwards.
This is also where the enrolment question from device management meets the data question. A device that was never collected is a device still carrying your configuration, in the hands of somebody outside your organisation, recorded in a third party's system as an open collection. All three of those facts are true simultaneously and each is owned by a different part of your company.
Proportionality, and not turning this into a programme
Everything above can be run as a short supplement to a process you already have, and it should be. The failure mode at the other end is a review so heavy that nobody completes it and the vendor gets onboarded informally while it is still in progress.
For most companies the proportionate version is a page of supplementary questions, a call where somebody who knows the operation answers them, a request for one sample wipe report, and three things written into the contract. That is a few hours of work spread over two weeks.
The deeper version is justified in specific situations: a regulated sector, a certification with device controls in scope, a customer contract that imposes obligations you are passing down, or a vendor handling an unusually large share of your estate. If none of those apply, the short version is genuinely sufficient and the time saved is better spent on the pilot.
What is not proportionate in either case is doing nothing, which is where most companies currently are. The gap between no assessment and a reasonable one is a page of questions and a meeting.
What getting this wrong actually costs
The visible cost is a finding during an audit or a certification, which is recoverable and embarrassing.
The accumulating cost is a data relationship nobody owns. An equipment vendor that has been operating for two years without a review holds a current map of where your employees live, shares some portion of it with partners you have never named, and retains historical records for people who left long ago. None of that is a breach. All of it is exposure you have accepted without deciding to.
The cost with the longest tail is disposal evidence you cannot produce. If you have been telling an auditor, an insurer or a customer that devices are securely destroyed, and the actual position is that a vendor wipes them to an unspecified standard with no per-device evidence, the gap between those two statements is yours rather than the vendor's. That one surfaces at the worst moment and cannot be fixed retrospectively, because the devices are gone.
So the question is not whether your vendor is trustworthy. It is whether anybody has established what they actually do, because in most companies the honest answer is that a form was completed and nobody read the part that mattered.
Who runs this review, and why it usually falls over
The review does not fail because the questions are hard. It fails because it sits between three functions and gets handed around until the timeline forces a decision.
Security owns the questionnaire and typically has no context on equipment logistics, so they run the standard form, get good answers about hosting and encryption, and sign off on a correct assessment of the wrong surface.
IT owns the vendor relationship and knows what actually happens operationally, but is usually focused on whether the service works rather than on who holds employee addresses, and frequently assumes security has covered it.
HR owns the employee data and generally has no visibility that an equipment vendor is a party to it at all, because the arrangement was procured as a logistics service.
Nobody is wrong. The dataset in question is visible from HR's position, the operational detail from IT's, and the assessment capability sits with security, and no single function holds more than one of those.
The arrangement that works is to let security own the process while IT answers the operational questions in the room. Not sequentially, in the same call, because the useful questions in this article depend on somebody who knows how deliveries actually work being present when the question is asked. A questionnaire routed between functions produces three partial answers; forty-five minutes with both functions and the vendor produces one complete one.
And name an owner for the relationship afterwards. Reviews produce findings, findings produce commitments, and commitments with no owner are not tracked to completion.
When this becomes a standing process rather than a one-off
For a single vendor relationship, a review at selection and a conversation at renewal is proportionate and sufficient.
It becomes a standing concern in two situations. The first is when the vendor's partner network changes, which happens more often than companies notice and which you will only learn about if you have asked to be told. The second is when your own footprint expands into markets the vendor serves differently, because the answers you got about your original markets do not transfer.
The practical arrangement is a short annual check rather than a repeat of the full review: confirm the subprocessor list is still accurate, confirm the retention position has not changed, and ask for a current wipe report. Fifteen minutes, once a year, against a relationship that touches every device and every employee address in the company.
If your equipment vendor has never been reviewed at all, the useful first step is not the full questionnaire. It is one email asking what employee data they hold and which markets are partner-served. The answer to that will tell you how much of the rest you need.
Frequently asked questions
Is an equipment vendor really a data processor?
In practice yes, and most companies have not classified them as one. To deliver and retrieve devices they hold employee names, home addresses and phone numbers, and aggregated across a workforce that is a current map of where your staff live. It is also a dataset that arrives one delivery at a time, which is why it rarely gets assessed as a dataset at all. Whether it attracts specific obligations depends on your jurisdiction and circumstances, so take local advice, but the practical exposure exists regardless of how it is classified.
What does a standard security questionnaire miss here?
The physical and subprocessor dimensions entirely. Standard questionnaires were designed for software suppliers, so they cover hosting, encryption at rest and access control, which an equipment vendor usually answers well because the platform component is built like any other product. They contain no question about who physically handles the device, what warehouse staff can see, which third parties receive employee data to complete a delivery, or what evidence exists that a drive was wiped. Run the standard form and add a one-page supplement.
What should I ask about subprocessors?
Four things. The list of which markets are served by the vendor's own operation and which by named partners. What each partner actually receives about your employees, since this ranges from a full delivery record with name, address and phone to just a reference number. Whether the vendor's contracts flow the same obligations down to partners, and whether anybody verifies that. And whether you are notified when a market changes hands, because partner networks shift and you will only hear about it if you have asked.
How do I assess device wiping properly?
Ask them to name the standard rather than accepting that devices are securely wiped, and expect a method appropriate to the drive type since solid state drives behave differently from spinning disks. Ask for evidence in the form of a per-device report with serial numbers, and ask to see a redacted sample. Then ask what happens when a wipe fails, because drives do fail and the right answer involves physical destruction with a certificate. A vendor admitting a nonzero failure rate is more credible than one implying it never happens.
Does the vendor need to be a certified ITAD provider?
Only if your compliance position requires formal destruction certificates, which many do not. Plenty of equipment vendors wipe devices competently without holding ITAD certification, and that is an honest and common arrangement rather than a deficiency. What matters is knowing which you have. If you have been telling an auditor or a customer that devices are certifiably destroyed and your vendor wipes without certification, that gap is yours to close, usually by adding a separate certified provider for end-of-life devices.
When should the security review happen?
Before the commitment, and a lighter version before the pilot. Reviewing a ninety-day trial to the same depth as a three-year contract is disproportionate, but running no review before a pilot means production employee data flows to an unassessed party. The practical sequence is a short version covering data held and subprocessors before the trial, then the full review including physical chain and disposal before signing. A vendor who cannot answer the core questions in a first call has told you something for the cost of one meeting.
What if our existing vendor was never reviewed?
Start with one email rather than a full questionnaire, asking what employee data they hold field by field and which markets are partner-served. Those two answers tell you how much of the rest you need and they are quick for the vendor to produce. Most companies find the exercise reassuring, because vendors in this category are generally doing sensible things; what they find uncomfortable is how much they had assumed rather than established. Treat it as closing a gap rather than as an investigation.
How often should this be repeated?
A short annual check rather than a full repeat. Confirm the subprocessor list is still accurate, confirm the data retention position has not changed, and ask for a current wipe report. That takes about fifteen minutes against a relationship touching every device and every employee home address in the company. Repeat the fuller review when something structural changes, specifically when the vendor's partner network shifts in a market you use, or when you expand into markets they serve through a different arrangement.
Where this leaves you
An equipment vendor sits in two positions most security processes do not examine: they hold a live map of where your employees live, and they physically touch every device before your staff do.
Run the standard questionnaire, because it covers the platform properly. Then add the page that covers the rest: what data they hold and for how long, which markets are partner-served and what those partners receive, who physically handles devices and what they do to them, and what evidence exists that a drive was actually wiped.
Ask it on a call rather than on a form. The detail in the answers is the finding.
Keep the whole thing proportionate. For most companies this is a page of supplementary questions, one call with security and IT both present, a sample wipe report and three clauses in the contract. The deeper version earns its place in regulated sectors, where a certification puts device controls in scope, or where a customer contract passes obligations down to you. Outside those, the short version is sufficient and the hours saved are better spent on the pilot.
And start it earlier than feels necessary. The single most useful property of this review is that a vendor who cannot answer the core questions on a first call has told you a great deal for the price of one meeting, long before you have written anything into a contract or moved any employee data. That is a cheap signal and almost nobody collects it.
The story at the start of this article ended well, in the sense that nothing went wrong and the company now knows who its subprocessors are. It is worth noticing how it was found: not by the procurement process, not by the questionnaire, not by security review, but by one person asking an obvious question four months late. The questions are not difficult. They are just not on the form.
