Tools and providers
Part of Choosing CRM tools for a small business, from workflow definition to exit
Small business CRM vendor due diligence: reading assurance papers
How to read a CRM supplier's assurance papers in England: match each certificate or report to the product, scope and dates before you approve the contract.
A supplier's assurance papers prove only what they say they cover. A certificate for one subsidiary, a report for another product or a badge past its date can sit in a trust pack and still not describe the CRM edition you are about to sign for. Reading the papers properly takes a few specific questions.
What to take away
- An assurance document counts only if it names this product, this environment and these dates.
- Read the ISO/IEC 27001 scope statement, not just the certificate.
- A SOC 2 Type 2 report is tied to a reporting period, so note the period and what covers the time since.
- Cyber Essentials Plus adds independent technical testing to the same five controls as Cyber Essentials.
- Grade each paper from supplier assertion to independent validation, and hold approval on an unresolved critical item.
Match every document to the product you are buying
An assurance document is evidence for your purchase only when it names the product, the environment and the dates that apply to you. Check each one against the edition in the signed order form. A certificate covering a different subsidiary is not evidence here.
Start from the order form that names the edition in scope, then lay each paper beside it. Note the entity, product, environment and date on every document, and mark any mismatch as unresolved. Running one real workflow through the service first shows which parts of the supplier the papers must cover.
Read the ISO/IEC 27001 scope statement
The scope statement matters more than the certificate itself. It says which services, sites and organisational units the certified management system covers. If your CRM edition, hosting or support team sits outside it, the certificate says nothing about your purchase.
Ask for the certificate together with its scope statement, and check that the product, environment and dates match your order. Where the scope reads broadly, ask the supplier to confirm in writing that the CRM edition and its hosting are inside it.
Read the SOC 2 Type 2 report and its period
A SOC 2 Type 2 report covers controls over a stated reporting period, so the dates are part of the evidence. A Type 1 report describes the design of controls at a single point in time, which says less about how the service has run.
Read the reporting period, the systems in scope and any exceptions the auditor noted. Record the date the period ended and ask what covers the time since then. A report whose period closed some time ago needs a question, not a pass.
See what Cyber Essentials Plus adds
Cyber Essentials Plus tests the same technical controls as Cyber Essentials, with independent verification. The NCSC says both assess the same five key technical controls, but Plus goes a step further by independently testing systems to verify that the controls work in practice.
Record the Cyber Essentials Plus status with the certificate's scope and date. Treat it as one gate among several, not a pass for the whole supplier, because a certified part of an organisation does not stand for the rest.
Check the signing entity first
The papers belong to a legal entity, so identify the one that signs. Record its legal name and company number, with the edition, the term and the governing-law clause. A group trading name and the invoicing company may differ.
A Companies House filing confirms registered particulars only. It cannot prove product quality, current solvency or contractual performance. Use it to match the name on each assurance paper to the name on the order form, and ask where they differ.
Grade each document on a confidence scale
Grade every document by how much independent checking sits behind it. The NCSC's cloud selection guidance describes confidence ranging from a supplier assertion to independent validation, and a badge is not a blanket pass. Record the grade beside each paper.
| Document | What it can show | What it cannot show | Question for the supplier |
|---|---|---|---|
| ISO/IEC 27001 certificate and scope statement | Which services, sites and units a certified system covers | That your edition is inside the scope | Are our edition and hosting inside the stated scope? |
| SOC 2 Type 2 report | How controls ran over a stated period | What happened after the period ended | What covers the time since the period closed? |
| Cyber Essentials Plus certificate | Independent testing of the technical controls | Coverage outside the certified scope | Which parts of the organisation are certified? |
| Supplier trust page | What the supplier asserts | Any independent check | Which document supports each claim? |
Papers say little about how the service behaves, so write the outcomes first: permitted identities, authentication, least privilege and logging. Then set expectations for incident support and recovery.
When a document is missing or does not match
A missing or mismatched document is an open question, not a pass. An unresolved critical item holds approval until the supplier answers in writing. Record the question, the person asked and the date, so the gap stays visible in the decision record.
Ask for the sub-processor list and the hosting locations as well. Trace each data type through the service, and record who chooses each purpose and the essential means. Then check sub-processors and hosting against the data the service touches.
Data flow and legal roles
- Contact details, notes, messages, attachments
- Enrichment and support access
- Who chooses purpose and essential means
- Sub-processors, locations, remote access, integrations
- ICO international transfers hub assessment
- Hosting region alone does not answer
The ICO's international transfers hub sets out the current route for assessing restricted transfers, safeguards and the data protection test. A hosting region alone does not answer that analysis.
Name who receives notice of changes to terms, prices, editions, sub-processors and security notices, and put it in the commercial contract. If notice cannot arrive by a dependable route, treat that as a contract point rather than a monitoring habit.
Test export, restore and deletion on synthetic data before signature, then again at exit. The proved export route is the evidence that the papers cannot supply.
Before you act
- Record the signing entity's legal name and company number.
- Lay each assurance document beside the signed order form.
- Read the ISO/IEC 27001 scope statement and the SOC 2 reporting period.
- Record the Cyber Essentials Plus status with its scope.
- Grade each paper from supplier assertion to independent validation.
- Hold approval while any critical item is unresolved.
Common questions
Which assurance documents should I request first?
Ask for the ISO/IEC 27001 scope statement, the SOC 2 Type 2 reporting period and Cyber Essentials Plus evidence. Match each document to the exact product, environment and dates. A certificate covering a different subsidiary is not evidence here.
Is a Companies House check enough to approve a supplier?
No. A filing confirms registered particulars only. It cannot prove product quality, current solvency or contractual performance, so use it to confirm the entity and rely on the other evidence for everything else.
Does a certificate prove the CRM edition is secure?
Not by itself. A certificate is tied to a scope and a date, and the NCSC describes confidence ranging from supplier assertion to independent validation. Check that the scope names your edition, then test the outcomes you care about.
