How to navigate IT security and vendor review for an employee survey tool

How do you get an employee survey platform through IT security and vendor review?

You get a survey platform approved by preparing the vendor's paperwork before your security team asks for it, and by running the four reviews at the same time instead of one after another. Four teams are involved: IT, your information security team (InfoSec for short), legal, and procurement. Most delays are not security objections. They are simply teams waiting on each other.

1. 01
   Documentation pack. Request the full security and compliance pack from the vendor in one message at the start: the security overview, DPA, sub-processor list, SSO and SAML setup guide, and data-flow diagram.
2. 02
   Email deliverability. Give IT the exact from-address and sending domain early and ask them to allowlist it, so survey invitations do not land in spam during launch.
3. 03
   SSO & access. Confirm SAML single sign-on with your existing identity provider, role-based access controls, and how the employee list gets provisioned and stays current.
4. 04
   Legal & procurement. Line up the NDA and DPA with legal, and pricing, contract and references with procurement, at the same time as the InfoSec questionnaire rather than after it.
5. 05
   Run in parallel. Run IT, InfoSec, legal and procurement as concurrent workstreams rather than as a queue. Sequencing them is the single biggest cause of multi-month approvals.

For the full documentation your security team will read, start with CultureMonkey's security and compliance documentation.

What documents does IT security and procurement actually ask for?

Between them, IT, InfoSec, legal and procurement will typically ask for ten to eleven documents. A few of these have technical names, but they are simple ideas: a sub-processor list is just the other companies the vendor relies on to run its service, and a data-flow diagram is a picture showing how your employees' answers move through the system. Request all of the documents from the vendor in one message at the start, not one at a time as each team surfaces its ask.

Sending a single request for the full pack, rather than drip-feeding asks as each team wakes up, is the cheapest week you will ever save. Pair this with a full vendor evaluation checklist for the broader commercial and implementation review.

Check the vendor's track record before you sponsor them

The documentation pack tells you what a vendor claims about itself today. It does not tell you how they have behaved. Before you put your name behind a vendor internally, ask three more questions: has there been a security incident in the last 24 months and how was it disclosed to customers, have any audits come back failed or qualified and what was remediated, and can they introduce you to a reference customer in your industry who has already been through the same review.

This matters because HR is usually the sponsor rather than the evaluator. When InfoSec asks whether you vouch for this vendor, you want to answer from what you have verified rather than relay the vendor's own marketing. As our reviewer Jeanette Winters puts it in her perspective above, know enough about your proposed new vendor to have the confidence to dig deep enough to represent them honestly.

How long does a vendor security review take, and what stretches it out?

Expect weeks to a few months. A small or mid-sized company with a light review process can clear it in two to four weeks. Large enterprises, regulated industries, and anyone running a formal InfoSec questionnaire should plan for several months.

Give the review enough time, and start it earlier

Running the four workstreams at once shortens the calendar. Compressing the testing window itself does not, it only moves the risk. Environmental and cybersecurity testing takes as long as it takes, and a review squeezed into the fortnight before a launch date tends to end one of two ways: a rejection, or a conditional approval carrying open gaps that resurface later.

The practical fix is to open the review while you are still shortlisting rather than after you have picked a winner and committed to a go-live date. The testing window is then set by your IT team's capacity rather than by your launch deadline.

What stretches a review out?

• Data-residency and sub-processor questions that need a second round with the vendor because they were not addressed in the first documentation pack.
• Missing or incomplete SSO and SAML documentation, which forces IT to pause and request it separately.
• Legal redlines on the DPA or contract that cannot move until InfoSec closes out its own workstream.
• Reference checks waiting on procurement's calendar after every other workstream has finished.
• Documentation requests arriving one item at a time rather than as a single pre-assembled pack.
• International data-protection requirements surfacing mid-review because nobody mapped where employees sit before the process started.

Residency and GDPR questions are a common delay trigger. For the mechanics of where data is hosted, transfer mechanisms, and regional rules, see data residency and GDPR questions. For the security criteria your InfoSec team is evaluating you against, see the security criteria checklist.

How do you stop survey invites from getting caught in spam filters?

Survey invitations get filtered for two reasons: your IT team has not allowlisted the sender, or the sending domain's authentication records are incomplete. Both are fixable before launch, and both are far easier to fix before the first send than after.

1. 1
   Allowlist the exact sender. Give IT the precise from-address and domain the invitations will come from and ask them to allowlist that specific sender. Allowlisting the sender is far more reliable than asking employees to fish messages out of Junk individually.
2. 2
   Check SPF and DKIM if you send from your own domain. SPF (Sender Policy Framework) lists which servers are permitted to send email for your domain. DKIM (DomainKeys Identified Mail) cryptographically signs your messages so the recipient can verify they were not forged or tampered with in transit. These records live in your domain's DNS, not in the survey platform, so the fix belongs to whoever manages your DNS.
3. 3
   Or use the vendor's default sender. If you send from the platform's own authenticated sender rather than a custom domain, SPF and DKIM are already handled and there is nothing for you to configure.

Sort these fixes out before your first send, not after invitations have already landed in junk. If deliverability is a deciding factor, favour a platform that handles sender authentication and offers non-email channels out of the box. Read about employee engagement survey tools for the broader evaluation context.

How do you satisfy SSO, access control and provisioning requirements?

IT will ask three things: can we use our existing single sign-on, can we control who sees what, and how does employee data get in and stay current. All three have straightforward answers, but the SSO answer is the one buyers most often get wrong in their own internal write-up.

For the full security posture and documentation your IT team will expect, see CultureMonkey's security and compliance documentation.

How do you clear the legal and procurement gate?

Legal and procurement run in parallel to InfoSec, and they ask for different things. Legal wants the NDA and the DPA. Procurement wants pricing, the contract, and customer references. Neither should be waiting on the security questionnaire to finish.

Who does what at each stage

With four teams involved, it helps to be clear on who leads each step and who just needs to be looped in. The table below shows, for every stage, which team owns it (does the work and signs off) and which teams are only consulted or kept in the loop. This kind of who-does-what map is often called a RACI chart.

How to accelerate approval: run workstreams in parallel and prep the vendor pack early

The fastest reviews are not the ones with the fewest questions. They are the ones where four teams work at the same time and the vendor's documentation arrives before anyone asks for it.

1. 01Request the full documentation pack in one message at the start, not one document at a time as each team surfaces its ask.
2. 02Book the InfoSec kickoff before the deal closes rather than after, so the questionnaire is already in flight when contracts are being reviewed.
3. 03Answer the security questionnaire in a single pass rather than in fragments. Partial answers require follow-up rounds that add weeks.
4. 04Pre-clear the email allowlist with IT before launch day, not after the first survey has already been sent into junk folders.

Jamie Notter

Speaker, Author and Culture Scientist

“

·S06 E20

Good conflict is just the right issues being dealt by the right people at the right time, and coming up with good resolutions around it.

Watch episode →

How CultureMonkey supports an IT security and vendor review

CultureMonkey supports an IT security and vendor review through security and compliance documentation for InfoSec, SAML single sign-on and role-based access controls for IT, HRIS provisioning to keep the employee list current, and non-email delivery channels for locked-down workforces.