Free tools Windows power users keep installed
One-click scans. No signup required.
Assess the specific supplier, product and transaction—not Korean suppliers as a category. Before signing or sharing data, review who controls the company, where its product and service dependencies come from, how it protects and restores systems, what data it can access, whether U.S. export controls apply, and whether the contract makes those obligations enforceable. Scale the depth of review to the supplier’s access and the business impact of an outage or compromise.
How should you scope the supplier review?
Start by defining what the supplier will provide and what could go wrong if it fails, is compromised or becomes unavailable. NIST’s final SP 1326, Cybersecurity Supply Chain Risk Management: Due Diligence Assessment Quick-Start Guide, published July 8, 2026, frames due diligence as gathering pertinent information about a supplier or product to inform acquisition decisions. Its dimensions include foreign ownership, control or influence (FOCI), provenance, resilience, foundational cyber practices and supply-chain tiers.
- Identify whether the relationship covers software, hardware, cloud hosting, managed services, engineering, support or components.
- List the systems and business processes that will depend on the supplier, the access privileges it needs, and the data it will handle.
- Set the outage tolerance and consider the consequences if the supplier or a critical upstream provider is unavailable.
- Use those answers to determine the evidence required, the people who must approve the relationship and how often it should be reviewed.
Who owns and operates the supplier—and what sits behind the product?
Confirm the contracting entity and build a practical picture of the organization behind it. A Korean headquarters or place of incorporation is not, by itself, a complete risk assessment. Review the company’s ownership, control, operating footprint and the actual product and transaction.
- Record the parent entities, beneficial ownership where available, governance, material affiliates and relevant jurisdictions.
- Ask who develops, hosts, maintains, updates and supports the product, and where those activities take place.
- Request a current list of critical subcontractors, hosting regions and material dependencies. Ask how the supplier will notify you of changes.
- For software or connected products, request product architecture and component or dependency information, along with secure development and release practices.
- Check how updates are signed and delivered, how vulnerabilities are reported and fixed, and when the product will reach end of support.
Ask for answers tied to the product and version you intend to buy, with dates where relevant. General corporate assurances may not establish the provenance or practices of the specific service.
#1 Best Overall
What cybersecurity and recovery evidence should you request?
Request evidence about controls that match the supplier’s access and the sensitivity of the systems and data involved. CISA’s supplier-assessment materials identify practical topics such as asset integrity, administrative access, staff training, incident detection and recovery; NIST SP 1326 supplies a broader supply-chain due diligence structure.
- Identity and access: How are accounts, privileged access and workforce access managed, reviewed and removed?
- Assets and configuration: How does the supplier inventory assets and maintain secure configurations and software integrity?
- Vulnerabilities and monitoring: What is the process for receiving vulnerability reports, prioritizing fixes, monitoring for incidents and escalating them to customers?
- Incident response: What notification, investigation and cooperation can the supplier provide if customer data or systems are affected?
- Recovery: How are backups protected and tested? What recovery arrangements and support coverage apply to the service?
- Assurance: If the supplier offers an audit report or certification, check its scope, exclusions, coverage period and whether it applies to the service you are purchasing.
A questionnaire or certificate is evidence to assess, not a substitute for checking whether the controls fit your deployment. Record material gaps, who owns each follow-up, target dates and any compensating measures.
What should you check before sharing data with a Korean vendor?
Map the data path before onboarding. Include not just the supplier’s primary systems but also remote support access, subprocessors and onward transfers. Ask the supplier to explain its role, purpose for processing, transfer arrangements, security controls and where support staff can access the data.
- Identify the data types and whether they include personal or sensitive personal data, financial information, regulated-sector data or national core technology information.
- Record where data is collected, stored and processed; which supplier and subprocessor personnel can access it; and from which locations.
- Document any onward transfers, retention periods, deletion method and evidence of deletion.
- Confirm the applicable incident-notification and cooperation obligations, and what audit or other evidence you can obtain.
The U.S. Trade Representative’s 2026 National Trade Estimate describes limits under Korea’s Personal Information Protection Act (PIPA) on some cross-border personal-data transfers. It also reports localization requirements for personal credit and unique identification information processed by financial institutions, and restrictions on foreign cloud providers for national core technology workloads. These are reasons to check whether a rule applies to your particular data and service—not evidence that all data must stay in Korea. Confirm current Korean requirements with qualified counsel for the actual use case.
Rank #3
Could U.S. export controls apply to the transaction?
Supplier location alone does not determine whether a transfer is permitted or requires a license. Identify any U.S.-origin or U.S.-controlled commodity, software, technology, technical data or service that will be provided, accessed remotely, reexported or transferred in-country, then determine the relevant classification, destination, end user and end use.
- Inventory the items and technical information involved, including what the supplier or downstream users will be able to access.
- Determine the applicable export classification and whether a license or other authorization is required for the planned destination, end user and end use.
- Identify the supplier, relevant owners, intermediaries and named end users, and screen parties against applicable restricted-party lists. The Commerce Department’s South Korea guide identifies the Consolidated Screening List as a screening aid.
- Repeat screening when parties, destinations or other transaction details change, and retain the review record.
- Refer classification and licensing questions to your export-control counsel or responsible compliance function. Defense articles and services may fall under the State Department’s ITAR jurisdiction rather than the Commerce Department’s EAR.
The Commerce guide notes that South Korea is among destinations not subject to certain rules described there. That does not remove all item-, party-, end-use- or U.S.-person-based controls, including controls over certain U.S.-person activities. Resolve the rules for the actual transaction rather than relying on the destination alone.
Can the supplier withstand disruption—and can you exit?
Review resilience across the supplier and its upstream dependencies. Ask about provider and geographic concentration, critical subcontractors, backup arrangements, recovery testing, service capacity, support coverage and incident communications. Consider operational and financial stability as part of the risk assessment, especially where a disruption would affect a critical business process.
Plan for the supplier’s failure as well as the product’s end of life. Determine what data, configurations and other materials you can export, how quickly a replacement could be deployed, and what transition assistance the supplier must provide. Define how the supplier will confirm return or deletion of your data at the end of the relationship.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How should you compare multiple suppliers?
Use the same evidence-based criteria for each candidate and record what is established, what remains unclear and what matters for the planned deployment. The framework below turns the main risk areas into a consistent comparison record.
| Review area | Compare candidates on | Evidence or record to request |
|---|---|---|
| Ownership and transparency | Ownership, control, material jurisdictions and visibility into relevant affiliates | Ownership and governance information; named contracting entity; operating locations |
| Provenance and dependencies | Product, software, component and service origins; subcontractor depth and concentration | Product/version details; architecture or dependency information; critical subcontractors and hosting regions |
| Security | Controls and assurance relevant to the actual service, access privileges and data | Scoped policies, technical or independent assurance evidence, and documented gaps |
| Resilience and exit | Incident response, recovery capability, upstream concentration and replacement feasibility | Recovery arrangements and testing information; dependency and transition plans |
| Data and legal fit | Data locations, access, transfers and implications for the data or sector involved | Data-flow details; subprocessor access; retention and deletion terms; applicable transfer arrangements |
| Export-control readiness | Transaction classification, party and end-user screening, and ability to support compliance | Item and party records, screening evidence and responsible compliance contact |
| Contract accountability | Security commitments, audit access, change notices, incident duties and transition obligations | Proposed agreement and service schedules, with material exceptions identified |
| Operational fit | Service levels, support coverage, integration effort and continuity needs | Service commitments and implementation and support details for the proposed use |
Which findings belong in the contract and decision record?
Put the controls you rely on into the agreement or service schedules rather than leaving them as informal assurances. CISA’s supplier guidance includes contractual security obligations as an assessment topic. Tailor the commitments to the risks and applicable requirements you have identified.
- Permitted data uses, access boundaries and location commitments where applicable.
- Minimum security controls, vulnerability handling and incident notification, cooperation and evidence.
- Subcontractor disclosure, approval where appropriate, and flow-down of relevant obligations.
- Continuity and recovery commitments, audit or evidence rights, and change notices.
- Retention, return and deletion requirements, plus transition assistance and termination rights.
Keep a decision record of the evidence reviewed, unresolved risks, owners, approval conditions and review cadence. Before making a binding decision, have the responsible security, privacy, export-control, procurement and legal teams validate the supplier, product/version, data flows, contract, end users and end uses against current U.S. and Korean requirements. This is a procurement framework, not a legal determination or security audit; the cited official guidance does not establish whether any unnamed supplier is acceptable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
