centrexIT Vendor Due Diligence Generator
Step 1 of 4
Who is the vendor?
Name the partner and tell us what kind of organization they are.
CRO (Contract Research Organization)
Runs studies or trials; handles clinical and research data
CMO / CDMO (Contract Manufacturing)
Manufactures product; handles GMP and batch records
Cloud / SaaS / Software vendor
Hosts systems or data, or provides a platform you log into
Laboratory / Testing partner
Sample analysis, QC testing, bioanalytical services
Logistics / Distribution / Cold chain
Storage, shipping, or temperature-controlled handling
Consultant / Professional services
Advisory, regulatory, or specialist staff with data access
Other / general supplier
Any other third party that touches your data or systems
Select a vendor type to continue.
What data will they handle?
Select all that apply. This decides which compliance sections appear in your questionnaire.
Records subject to 21 CFR Part 11
Electronic records / signatures in FDA-regulated systems
Clinical or patient data
PHI, trial subject data, or GDPR special-category data
Proprietary research data or IP
Formulations, trial designs, assay methods, source code
GMP manufacturing / batch records
Production, quality, and batch-release records
Regulatory submission data
Data supporting filings to FDA, EMA, or other regulators
No sensitive data — operational only
Administrative or operational information only
How much access will they have?
Access depth drives how deep your due diligence should go.
No system access
Data exchanged via files or reports only
Limited access
Specific systems, read-only, or a defined integration
Deep / privileged access
Integrated systems, admin rights, or they host your data
Select an access level to continue.
Regulatory and framework context
Optional. Select any that apply so the questionnaire reflects the right expectations.
FDA-regulated (GxP)
GMP, GLP, or GCP obligations apply
HIPAA
US protected health information is involved
EU GDPR / EMA Annex 11
EU personal data or EU regulated systems
SOC 2 / ISO 27001 expected
You expect a recognized security attestation
Vendor Due Diligence Questionnaire
Want an expert to run this for you?
centrexIT has helped life-science organizations vet and secure their supply-chain partners since 2002. We can evaluate a vendor's responses, validate their evidence, and tell you where the real risk is.
Book a Free 30-Minute Consultation
Estimates for planning purposes only; not legal, compliance, tax, or financial advice.
centrexIT — managed IT and cybersecurity since 2002.
Want additional insights sent to your inbox?
We'll send a personalized summary with recommendations based on your results.