Vendor due diligence for infrastructure logistics means verifying a provider's screening, subcontracting, insurance, facilities, certifications, and incident history before handing it physical access to your data center, custody of your hardware, and a role in processes your auditors examine. Such providers are frequently selected on price by a project team working against a lease expiration.
Due diligence here is not a procurement formality. The controls you are certified against do not stop applying because a vendor is performing the work.
Do Your Compliance Obligations Extend to the Provider?
Yes. Regulatory frameworks treat outsourced activity as the organization's responsibility. A HIPAA-covered entity remains accountable for protected health information handled by a service provider. PCI DSS requirements extend to service providers with access to cardholder data environments. SOX controls over financially significant systems apply to whoever is executing them.
This has a concrete implication: the provider needs to be able to demonstrate the controls, because you will be asked to demonstrate them and their evidence will become yours.
Identify which frameworks apply before evaluating anyone. The diligence for a move of general corporate infrastructure is different from the diligence for systems in a cardholder data environment, and knowing which you are running prevents both an inadequate review and a needlessly expensive one.
What Should You Verify About a Logistics Provider?
Personnel screening. Background check scope, how far back, whether it is repeated periodically, and — the important one — whether it covers subcontracted labor. Many providers staff peak work through temporary labor agencies. Ask specifically how those workers are screened, because the answer is frequently different from the answer for direct employees.
Subcontracting. Whether the provider performs the work with their own people and equipment or brokers it. Brokered freight is normal in logistics and is not disqualifying, but you need to know it is happening, who the parties are, and whether your requirements flow down to them contractually. A chain of custody that passes through an unvetted subcontractor is not a chain of custody.
Insurance. Cargo coverage limits, general liability, workers compensation, and professional liability where applicable. Obtain the certificate rather than the assertion, check whether coverage extends to subcontractors, and confirm the limits are proportionate to what you are shipping.
Facilities. If equipment will be stored, understand the storage: access control, physical surveillance, environmental conditions, whether the space is dedicated or shared, and whether you can inspect it. Ask to visit. A provider who will not permit a site visit to a facility that will hold your production systems has answered a different question than the one you asked.
Certifications. SOC 2 Type II is the most broadly relevant attestation. Read the report rather than accepting the logo — check the scope, the period covered, whether it includes the specific services you are buying, and what exceptions the auditor noted. ISO 27001 and industry-specific certifications matter where they map to your requirements.
Media handling. Where media is involved, how drives are handled, whether destruction is performed in-house or subcontracted, what certificates are issued, and against which standard. NIST SP 800-88 is the common reference for sanitization.
Incident history and response. Whether they have had a loss, theft, or breach event, what happened, and what changed as a result. A provider with a candid answer and a documented remediation is generally a better risk than one claiming a spotless record.
Which Reference Questions Are Worth Asking?
Ask for references from organizations of similar size in a similar regulatory posture, and ask them specific questions rather than general ones.
What went wrong, and how did the provider handle it. Whether the team on site matched the team in the proposal. Whether the schedule held and what happened when it did not. Whether documentation was delivered as promised. Whether they would use them again for something larger.
The question about what went wrong is the productive one. Every project of consequence has an incident. How a provider behaved during theirs predicts how they will behave during yours far better than a proposal does.
Getting It Into the Contract
Diligence findings that do not become contractual terms are findings that expire at signature.
Specify screening requirements including flow-down to subcontractors. Specify insurance limits and the certificate requirement. Specify notification obligations and timelines for loss, damage, or security incidents. Specify audit and inspection rights. Specify what documentation gets delivered and when — chain of custody records, asset reconciliation, destruction certificates.
Address subcontracting explicitly: whether it is permitted, whether it requires approval, and that all requirements flow down. Address data handling and confidentiality with terms that survive the engagement.
Name the key personnel where a specific project manager or lead technician was part of why you selected the provider.
Ongoing Rather Than One-Time
For a single project, diligence is a gate before award. For an ongoing relationship, it is a cycle.
Certifications lapse and get renewed with different scopes. Insurance renews at different limits. Providers get acquired, change subcontractors, and reorganize the team that served you well last year. Reassess annually, refresh the certificates, and re-read the SOC 2 rather than filing it.
Keep the record. When an auditor asks how you assured yourself that a third party with access to regulated systems was appropriately controlled, the answer is the diligence file — and it is only an answer if it is current.