The Ten-Person Vendor With Big Access: Right-Sizing the Security Ask

The vendor questionnaire was built for Salesforce. It asks about the SOC 2 report, the dedicated security team, the 24/7 monitoring operation. Your most critical vendor - the ten-person shop that runs your industry-specific system, the one your whole operation depends on - cannot answer half of it, and the half they can answer worries you.

This is the most common third-party risk situation in the mid-market, and the standard playbook handles it worst. Sending the enterprise questionnaire produces either a fictional answer set or a stalled relationship. Walking away is rarely an option; the vendor is critical precisely because there is no easy alternative.

The working approach is proportional assessment: smaller questions, better aimed, that tell you what you actually need to know about a small vendor holding big access.

Key takeaways

• The enterprise questionnaire fails on small vendors; proportionate questions tell you more.

• Ask about the few things that would actually hurt you: their backups, their access hygiene, their people risk.

• Their size is itself the risk to assess: key-person dependency, succession, survival.

• Compensate for their gaps with your own controls: your exports, your monitoring, your exit test.

• The relationship conversation beats the questionnaire every time.

Step 1: Replace the questionnaire with the conversation

The enterprise questionnaire asks a ten-person company to cosplay an enterprise. The honest instrument is a one-hour conversation with the owner or lead developer, and the questions are the ones their size can answer truthfully.

Ask how they back up your data and when they last restored it. Ask who has access to your data and how it is removed when someone leaves. Ask what happened the last time something broke badly. Ask what happens to your data if the company is sold.

Small vendors answer these questions well or badly, and both answers are information. The polished non-answer from a ten-person shop tells you as much as the detail you were hoping for.

Step 2: Assess the size itself

The vendor's scale is the risk factor the questionnaire never captures. Who else can run the system if the founder is hit by the proverbial bus? What is the succession story? Are they growing, stable, or quietly shrinking?

This fictional example shows the proportional scorecard for one critical small vendor. It is an illustration, not a prescription.

Question	Answer	Concern level
Data backups + tested restore	Weekly, restored in March	Low
People who can run the system	2 of 10	Medium
Your data if they are acquired	'Would honor terms' - unwritten	Medium
Financial trajectory	Stable, 12 years old	Low

None of these answers comes from a questionnaire. All of them come from a relationship.

Step 3: Compensate from your side

Where the vendor's size leaves gaps, your own controls close them. Keep your own current export of your data, tested for readability. Watch your own logs for how their access is used. Keep the exit test current - the 90-day question matters most exactly where the vendor is smallest.

This is the load-bearing insight of proportional assessment: you cannot make a ten-person vendor into an enterprise, but you can make your company resilient to their being one.

The standing-access questions from agent-driven vendor tools apply here in their original form: know what they can touch, and keep the list short.

Step 4: Put the relationship on a calendar

The small-vendor assessment is not an annual event; it is a relationship with a rhythm. Two conversations a year, one of them in person if geography allows. The agenda is short: how is the business, what changed, here is what we depend on you for.

The rhythm pays in advance warning. Small vendors telegraph their trouble months before it arrives - the slow replies, the departed developer, the missed release - and you see the signals only if you are looking.

Feed what you learn into the same register as the enterprise vendors. The reporting discipline in board-level third-party risk works for the ten-person shop too; the board should know which small names carry the big dependencies.

The related discussion of exit test is worth your time alongside this one. The related discussion of board-level third-party risk is worth your time alongside this one.

Frequently asked questions

Should we require a SOC 2 from a critical small vendor?

Requiring what they cannot produce ends the conversation, not the risk. Ask the proportional questions instead, compensate from your side, and revisit as they grow - a vendor getting serious about security will usually say so without being forced.

What if the conversation produces worrying answers?

Then it worked. A worrying answer you have is better than a comforting fiction you believed. The follow-ups are concrete: your own exports, your own monitoring, your exit plan, and - sometimes - the search for an alternative beginning early.

How do we justify the relationship to our own customers or auditors?

With the assessment record. 'We reviewed their backup practice, tested our own export, and maintain an exit plan' is a defensible sentence. 'We sent them a questionnaire they could not complete' is not.

A Defensible Next Step

Name your smallest critical vendor and book the conversation this month: backups, access, their bench, their future. An hour of honest talk beats a questionnaire nobody can truthfully sign. Book a Decision-Clarity Call if you want the conversation guide drafted.