Recommended Free Tools
Evaluate a security vendor against your organization’s actual risks—not its demo, marketing claims, or a generic score. Define the outcome you need, the data and access involved, and the consequences if the product or supplier fails. Then compare vendors using the same requirements and dated evidence, document the gaps you accept, and reassess important suppliers as circumstances change.
This framework applies to cybersecurity products and services, as well as other information and communications technology (ICT) suppliers whose software or services could affect security. The depth of review should match the supplier’s importance to your operations and the sensitivity of the systems or information at stake.
1. Define what the vendor must protect or enable
Write down the security problem before inviting vendors to demonstrate their products. A requirement such as “improve endpoint security” is too broad to evaluate consistently. State which systems are in scope, what threats or failure scenarios matter, and what outcome would count as useful in your environment.
Record the product’s expected integrations, data access, administrative privileges, availability needs, and dependencies. Include the operational consequences of an outage, compromise, incorrect alert, or unsupported product. These details determine what evidence you need and how much supplier risk you can accept.
#1 Best Overall
Set minimum requirements before demos or proposals arrive. CISA recommends putting cybersecurity requirements in procurement documents and evaluating vendors against them. Tailor legal, regulatory, and procurement obligations to your jurisdiction and sector; U.S. government guidance is not legal advice or a substitute for local requirements.
Build a short requirements brief
- Purpose: What security outcome should the product or service deliver?
- Scope: Which systems, users, data, locations, and integrations are involved?
- Access: What privileges, credentials, or administrative actions will the supplier or product need?
- Failure impact: What happens if the service is unavailable, compromised, or no longer supported?
- Operating model: Who will administer it, investigate alerts, apply updates, and coordinate incidents?
- Exit: What data, logs, access, or integrations must be recoverable or removable if the relationship ends?
2. Assess both the supplier and the product
A product can appear capable while the company behind it has weak support, opaque dependencies, or limited resilience. Conversely, a supplier’s general security credentials do not prove that a particular product fits your threat scenarios. Assess both, and follow important dependencies beyond the immediate vendor where practical.
NIST Special Publication 1326, published July 8, 2026, frames ICT supplier due diligence around foreign ownership, control, or influence (FOCI), provenance, resilience, foundational cyber practices, and supply-chain tiers. It can inform both new acquisitions and reviews of systems already in use. The right depth depends on your organization’s exposure and the supplier’s criticality.
Rank #2
Supplier and product areas to examine
- Ownership and control: Understand who owns or controls the supplier and whether that creates relevant legal, operational, or access concerns for your organization.
- Provenance and dependencies: Ask where important product components come from and which subcontractors or service providers can access your data or support delivery.
- Resilience: Examine how the supplier would maintain or restore the service through disruption, and what recovery or continuity arrangements matter to your use case.
- Foundational practices: Seek evidence about secure development, vulnerability handling, update support, incident response, and recovery—not just policy statements.
- Supply-chain tiers: Identify dependencies that could materially affect security, availability, or support, especially where the product relies on other providers.
CISA’s 2024 Software Acquisition Guide covers software across deployment models, including SaaS and cloud services, mobile and desktop applications, server software, and device firmware. A hosted product is still software acquisition from a security perspective; deployment model changes the questions, not the need to ask them.
3. Ask for evidence, not just assurances
For each material claim, ask what artifact supports it, what product or service scope it covers, when it was produced, and what it excludes. A yes-or-no answer may help identify a topic, but it is not enough to establish how a practice works or whether it applies to the product you are buying.
Evidence might include relevant policies, process descriptions, assessment results, product documentation, or contractual commitments. Ask about independent assessment where it is relevant, but verify its scope and date rather than treating the word “independent” as a complete conclusion. If a vendor cannot provide sensitive material, ask whether it can provide a suitably scoped summary or explain how you can validate the claim.
Evidence checklist
- Vulnerabilities: How does the supplier identify, triage, disclose, and remediate vulnerabilities? Ask for the process for root-cause analysis, not only a statement that vulnerabilities are fixed.
- Updates and support: What patch support applies, and what timelines or end-of-support conditions are documented?
- Development and testing: What secure-development practices apply to the product and its major changes? What independent testing, if any, covers the relevant components?
- Components: Can the supplier provide a software component inventory appropriate to the product? CISA’s software supply-chain guidance treats component inventories as useful procurement information. If one is unavailable, treat that as a risk signal to investigate in context—not proof by itself that the product is insecure.
- Incidents and recovery: What detection, customer notification, response, recovery, and customer-cooperation commitments are documented?
- Claims and exclusions: For a certification, control report, or other assurance claim, what was assessed, by whom, when, and what was outside the assessment?
- Contract terms: Which security duties, notification expectations, support commitments, and cooperation obligations are binding rather than merely described in sales material?
Questions to put to the vendor
- What data does the service process, where is it stored, and which subcontractors or service providers can access it?
- Who owns or controls the supplier, and what is the provenance of key product components and dependencies?
- How are vulnerabilities found, triaged, disclosed, and fixed, and what patch support timelines apply?
- What detection, incident notification, response, recovery, and customer-cooperation commitments are documented?
- What happens to customer data, access, logs, and integrations at termination, and what evidence of transition or deletion can you provide?
- Which material changes or incidents will prompt customer notice, and what information will that notice include?
Adapt the questions to the product and your risk. CISA’s small and medium business vendor-assessment template, revised October 26, 2021, is a practical starting point that can be adapted to an acquirer’s or integrator’s role. Its fact sheet, published April 3, 2023, also describes supplier-assessment considerations.
4. Check whether the product fits your environment
Security capabilities only help if they cover the systems and threats you actually care about and can be operated effectively. Compare the vendor’s stated coverage with your requirements, then test the assumptions that matter: integrations, administrative workflow, alert handling, support availability, and the staff time needed to maintain the product.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Framework mappings can organize questions, but they do not replace evidence. CISA describes MITRE ATT&CK as a common language for threat modeling, identifying defensive gaps, organizing detections, and assessing security-tool capabilities. When a vendor presents an ATT&CK mapping, ask which tactics and techniques are covered, how the mapping was produced, and what detection or mitigation evidence supports it. CISA’s mapping best practices address quality and common mapping errors. A mapping is not a guarantee that a product will prevent or detect an attack in your environment.
Rank #4
Read test results and attestations in context
For any benchmark, certification, control report, test result, or framework mapping, check the version, configuration, deployment, threat set, product components, assessment date, independence, and omitted capabilities. Then compare that scope with your own deployment and threat model. A polished report with a different scope from your use case may be less informative than narrower evidence that directly addresses it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.5. Compare every contender against one scorecard
Use the same definitions and evidence standard for each vendor, and decide the relative importance of each area before demonstrations. This reduces the chance that a persuasive presentation changes the criteria halfway through the evaluation. There is no universal weighting: a supplier with privileged access to sensitive systems may warrant more scrutiny than a low-impact tool.
| Comparison area | What to compare | Useful evidence or decision question |
|---|---|---|
| Security outcome and coverage | Fit for the threat scenarios and systems in your requirements brief | What capabilities are evidenced for your deployment, and what important gaps remain? |
| Supplier risk | Ownership or control, component provenance, key dependencies, and resilience | Which supplier or supply-chain risks could affect your organization, and how are they addressed? |
| Evidence quality | Scope, recency, independence, and relevance of reports or artifacts | Does the evidence cover this product and use case, or leave material questions unanswered? |
| Vulnerability and update support | Disclosure, remediation, patch support, and end-of-support expectations | Are processes and commitments sufficiently clear for your exposure and operating needs? |
| Integration and workload | Deployment effort, administration, alert workflow, and required staff capacity | Can your team operate the product and act on its outputs consistently? |
| Data, incidents, and exit | Data access and handling, incident cooperation, and transition or deletion at termination | Are the arrangements suitable for the information and operational dependency involved? |
| Contract commitments | Whether important security claims and support expectations are documented obligations | Which commitments can you rely on, and what remains an uncommitted assurance? |
| Total cost | Costs relevant to the chosen deployment and its operation | What implementation, integration, administration, and transition effort belongs in the comparison? |
Record evidence and gaps separately from any score. A numerical score can aid comparison, but it should not conceal a critical unresolved issue or make an unsupported claim look equivalent to verified evidence. CISA’s Cross-Sector Cybersecurity Performance Goals recommend evaluating cybersecurity procurement requirements and preferring the more secure offer when function and cost are roughly similar; that is a decision principle, not a universal ranking formula.
6. Make the decision traceable
Before selecting a supplier, create a record that lets someone else understand what was decided and why. Keep the evidence reviewed, its dates and scope, material unknowns, accepted risks, mitigation owners, contract commitments, and rationale together. Note what would trigger another review, such as a major product change or a change in the supplier’s risk profile.
- Confirm the requirements: Check the final offer against the minimums and priorities set before vendor demonstrations.
- Resolve material gaps: Request clarification or additional evidence for unanswered questions that could change the decision.
- Assign accepted risks: Name an owner for each accepted risk and record the mitigation or monitoring action, if one is needed.
- Secure commitments: Put material security, support, incident, and exit obligations into the relevant agreement where appropriate.
- Record the rationale: Explain why the selected option is suitable relative to the alternatives and what evidence supports that judgment.
7. Reassess the supplier after purchase
Vendor evaluation is not a one-time gate. CISA’s acquisition guidance places selection within a wider lifecycle that includes post-award monitoring, and NIST SP 1326 can inform due diligence for existing systems as well as new acquisitions. Set a review cadence proportionate to supplier criticality, then revisit sooner when a meaningful change occurs.
- A security incident, newly disclosed vulnerability, or missed security commitment;
- a change in ownership, control, important subcontractors, or product dependencies;
- a major product, hosting, or service-model change;
- a shift in your organization’s use of the product, the data it handles, or its operational importance;
- a change in support, patching, recovery, or exit arrangements.
Keep the original assessment available so a reassessment can focus on what changed rather than repeat every question without context. If a material risk cannot be resolved, decide whether to mitigate it, restrict the use, seek an alternative, or accept it through the appropriate internal process.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
