Investigating a studio equipment vendor from identity to continuity evidence

Run due diligence on the entity that will actually contract, deliver, support and exit the service. A familiar brand on a product page may differ from the reseller, installer, cloud provider or finance firm handling the England transaction. This checklist records evidence gaps; it does not certify a vendor.

This is a business-to-business checklist for buyers, not consumer advice. Consumer purchases need separate review under consumer law.

What to take away

Identity and authority

Record legal and trading names, company number where applicable, registered and service addresses, VAT details, signatory authority, product edition, territory and subcontractors. The official Companies House service can verify public UK company information, but registration does not demonstrate solvency, competence or authorised reseller status. Obtain the relevant authority from the manufacturer or contracting documents.

Deliverable and responsibility map

Define hardware, software, installation, training, support, updates and exclusions. Assign who supplies manuals, declarations, serial records, safety notices, accessibility evidence and incident contacts. OPSS product-safety guidance distinguishes manufacturers, importers and distributors. Check the exact role instead of transferring every duty to the vendor by assertion.

Security and privileged access

Map every account, connection, remote-support route and person with elevated access. Ask for policies, recovery evidence, vulnerability handling, breach notification, test scope and certificate expiry. The NCSC's supplier assurance questions cover governance, incidents, networks, offshoring, data, personnel and independent assurance.

For an ISO/IEC 27001 certificate, check the issuing certification body is accredited by UKAS and named, for example BSI or LRQA. Read the scope statement to see whether it covers the contracting entity and the studio services. Record the issue and expiry dates against the contract start date.

Read the statement of applicability or exclusions for missing controls. A certificate issued to a parent company or a data centre does not cover a different contracting entity.

Personal data and service changes

Identify controller, processor and sub-processor roles by actual decision, plus purposes, fields, locations, transfers, retention, deletion and rights assistance. ICO contract guidance sets out Article 28 content where a processor is used. Record how the customer learns of a new sub-processor or changed data route and what choice follows.

Access, rights and commercial terms

Accessibility

Require task-level evidence for installation, core operation, help, outputs and support. Government inclusive communication guidance is public-sector oriented, so a named accessibility specialist must set the applicable requirement rather than claim certification from that page.

Rights and contract

Confirm licence, media and output rights, confidentiality, warranty, repair, renewal, tax, liability, insurance, cancellation and price-change mechanics. For business-to-business terms, check exclusion clauses against the Unfair Contract Terms Act 1977. Consumer-facing terms need separate review under current CMA unfair-contract guidance. Credit, leasing or insurance offers also need their own FCA perimeter decision.

Finance and quotations

Normalise the commercial response to one unit, territory and period. Mark VAT, delivery, accessories, mandatory accounts, training, storage, support tiers, overage, renewal notice and exit work as included, excluded or unknown.

Do not fill a blank with a typical market assumption. The finance owner should record the approval ceiling and the change that sends the quotation back for review.

For a worked example, take one camera kit in England over 36 months: included may cover delivery and basic support, excluded may cover VAT and spare parts, and unknown may cover renewal uplift. Mark every unknown as unresolved and return it to the vendor.

Incident, support and continuity evidence

Ask for the severity definition, support clock, escalation contact and evidence retained after a fault. Request the current recovery method, recent test scope and customer responsibilities, without claiming that a stated target was achieved. Identify an alternative capture or editing route if the supplier, account or device becomes unavailable.

Where remote support can reach studio systems, require named authorisation, time-limited access, activity records and credential removal. The security owner decides whether the evidence fits the risk; procurement staff should not infer assurance from a sales response alone.

Exit and continuing evidence

Test export format, project restoration, asset return, account closure, credential revocation; per answer, name an owner, expiry and recheck trigger. Test data deletion, backup limits, equipment take-back, continuity during failure.

Reject or pause if mandatory control lacks evidence, the vendor refuses a workable exit, or the contract contradicts documented service.

Repeat targeted diligence at renewal, ownership change, material sub-processor change, serious incident or product end-of-support. Archive the superseded answer beside the new decision so the team can see what changed and which productions are affected.

Archive signed contracts, variations, acceptance tests, security questionnaires, data processing agreements, sub-processor notices, incident reports, exit test results, invoices and decision notes. In England, the limitation period for simple contract claims is six years, so keep core records for the contract term plus six years, unless tax or sector rules require longer.

Keep the decision log with the version of each record it relied on.

Before you act

Common questions

How can I verify a vendor's legal identity and authority?

See 'Identity and authority' above.

What should I check regarding security and privileged access?

See 'Security and privileged access' above.

How do I handle personal data and service changes?

See 'Personal data and service changes' above.