The Vendor Due-Diligence Record: What Risk Managers Should Document Before a Security Failure Becomes a Claim

The most defensible vendor decision is the one you can reconstruct later: the criteria, the limitations, the evidence, and the oversight behind it.

Risk managers put a lot of effort into asking whether a control will reduce risk. They should put nearly as much into a second question: if this control fails, can we show why we chose it and how we watched it?

That second question matters most with security vendors. Proposals promise AI detection, 24/7 monitoring, faster response, analytics, and law-enforcement escalation. After a serious incident, the questions get much narrower. What did the system actually see? Who responded? What was logged? What was retained? And what did the buyer do when performance problems showed up?

I’m not saying a poor vendor choice automatically creates professional liability. Duties, causation, and standards of care vary by role and jurisdiction. My point is that vendor selection and oversight can become part of the factual record examined after a loss. If that record shows a disciplined process, you are in a much stronger position than if it shows a purchase driven by price, camera count, or sales claims.

Start with the record you would want after a claim

Picture the first week after a major incident. Counsel, claims, management, and possibly law enforcement all want information, and they want it fast. Can your vendor deliver it?

You should be able to do four things without digging through days of raw footage:

1. Identify the event.
2. Point to a timestamped record of review and response.
3. Show the documented escalation steps.
4. Confirm the evidence is still available under the retention policy.

Those four tests turn vendor due diligence from a feature comparison into a defensibility exercise.

Five questions to ask before selecting a security vendor

1. What is detected in real time, and what is merely recorded?
   A camera that records around the clock can be useful evidence, but only if someone can find and retain the relevant footage. If the vendor sells proactive detection, document which events the system actually detects, what limitations apply, and what happens when the software is uncertain.
2. Where does human judgment enter the workflow?
   When AI flags an event, a person has to review it. That person needs defined training and clear authority to intervene or escalate. Know exactly where automation ends and human accountability begins.
3. What evidence does the system create automatically?
   Ask for a sample incident record. Useful fields include timestamp, location, event type, reviewer, disposition, response action, response time, escalation, and linked video. “We monitor 24/7” is a service claim. A retrievable incident log is evidence.
4. Who owns the data, how long is it retained, and how is it exported?
   The best incident record is worthless if it is overwritten before the claim reaches the right desk. Your contract should address ownership, retention, access rights, privacy, cybersecurity, legal holds, and the process for exporting video and logs.
5. How is performance reviewed after implementation?
   Oversight does not end at installation. The file should show recurring reviews of response times, outages, repeat incident locations, false alarms, missed events, escalation performance, and corrective actions. A control nobody reviews is hard to tell apart from one that exists only on paper.

What this looks like in practice

Public incident data from one multifamily property shows the point. This is a 1,023-unit apartment community in the Denver area. It had used on-site guards and mobile surveillance, then added an AI-enabled remote-guarding system in 2023. Trained agents review flagged events and can intervene in real time. According to figures reported by the Arapahoe County Sheriff’s Office, the property saw a 63% reduction in specified incident categories, zero break-ins, and a median guard response time of roughly 30 seconds.

Those outcomes are notable, but the due-diligence lesson travels better than the technology. The program produced event logs, response records, incident video, and performance data that management could review and preserve. Compare that to a vendor file holding a proposal, an invoice, and a statement of work. They are very different records.

What belongs in the vendor due-diligence file

• The business problem and risk the vendor was selected to address.
• The alternatives considered and the criteria used to compare them.
• Documented limitations, assumptions, coverage areas, and known blind spots.
• An escalation matrix showing who gets contacted and under what conditions.
• A process for preserving relevant data when a serious incident or claim occurs.

The professional liability value is in the process

No risk professional can eliminate every loss, and no well-run security program can guarantee a favorable liability outcome. A better goal is to show a reasoned process. The risk was identified. The vendor was measured against defined criteria, and its limitations were understood. Performance was monitored afterward, and problems were addressed when they surfaced.

That discipline applies to any AI-enabled vendor sitting inside a material risk-control process. The technology is new. The professional liability principle is not: good decisions are easier to defend when the record shows how they were made.

Meet the Author

Jason Tuohy

Managing Director, NCS Systems

Jason Tuohy leads NCS Systems, a risk intelligence firm helping commercial real estate owners, brokers, and asset managers close the documentation gap between security operations and legal and insurance exposure. NCS works at the intersection of AI-based remote guarding, foreseeability documentation, and underwriting-ready risk records, helping owners defend against negligent security litigation while strengthening their position in a hardening E&S insurance market. Jason speaks and consults on turning security data into a defensible, audit-ready record for courts, carriers, and boards.