DAM security and procurement review

What the DAM security review covers

A DAM security review covers four domains: assurance evidence, data protection, technical and operational controls, and vendor viability. Each domain has its own documents and its own internal reviewer, so the review runs as four parallel tracks under one owner.

DAMSelection gives practical guidance for buyers and is no substitute for legal advice. Involve the privacy officer and legal counsel for the data processing agreement and the contract terms. The security requirements guide covers what to require, and the security review verifies it.

ISO/IEC 27001 certificates

An ISO/IEC 27001 certificate shows that an accredited certification body has audited the vendor's information security management system against the standard's requirements. Fact: the current edition is ISO/IEC 27001:2022, amended by Amd 1:2024 on climate action changes. The certificate proves a managed system exists. The SOC 2 report, the penetration test and the demo evidence show how strong individual controls are in the DAM product.

Check five points on every certificate:

• Edition: the certificate cites ISO/IEC 27001:2022. Fact: under IAF MD 26:2023, all certifications to the 2013 edition expired or were withdrawn at the end of the transition period on 31 October 2025.
• Scope: the scope statement names the DAM product, the hosting operations and the support organisation that will serve the buyer.
• Validity: the certificate is in date, and annual surveillance audits are current.
• Issuer: the certification body is accredited by a national accreditation body, and the certificate can be checked with the issuer.
• Statement of Applicability: the vendor shares it, or a summary, so the reviewer sees which Annex A controls apply.

A certificate whose scope covers only a head office or a different product gives no assurance for the DAM. Ask the vendor to confirm the scope in writing.

SOC 2 reports

A SOC 2 report is an independent auditor's examination of a service organisation's controls, issued under AICPA attestation standards. Fact: the examination is built on the AICPA Trust Services Criteria for five categories: security, availability, processing integrity, confidentiality and privacy. Vendors choose which categories are in scope, so check the list against the buyer's needs.

Two report types exist. A Type 1 report assesses the design of controls at a point in time. A Type 2 report also tests whether controls operated effectively over a stated review period, and carries far more weight in a DAM review.

Read a SOC 2 Type 2 report in this order:

1. Auditor's opinion: look for a qualified opinion or a scope limitation.
2. System description: confirm the DAM product, regions and teams are inside the system boundary.
3. Exceptions: read every tested control with an exception and the vendor's response.
4. Subservice organisations: note which hosting and service providers are carved out and need their own reports.
5. Complementary user entity controls: list the controls the buyer must operate, such as user access reviews and single sign-on.
6. Period end date: request a bridge letter when the period ended more than three months ago.

SOC 2 reports are restricted-use documents. Expect a non-disclosure agreement before the vendor shares one.

GDPR data processing agreement

A DAM vendor that stores images, video or metadata showing or naming people acts as a processor under the GDPR, and the buyer needs a data processing agreement that meets Article 28. Product photos with models, event images, employee portraits and model release scans all contain personal data.

Fact: Article 28(3) GDPR requires the contract to set out the subject-matter, duration, nature and purpose of processing, the types of personal data and the categories of data subjects. The same article lists obligations the processor must accept. Check that the agreement contains each one:

Fact: Article 33(2) requires the processor to notify the controller without undue delay after becoming aware of a personal data breach. The controller then has 72 hours, where feasible, to notify the supervisory authority under Article 33(1). Write a concrete notification deadline in hours into the agreement, so the buyer can meet its own 72-hour clock. The European Commission's standard contractual clauses under Article 28(7), Implementing Decision (EU) 2021/915, give a tested template.

Sub-processors and international transfers

The DAM sub-processor list shows every third party that touches the buyer's assets, and Article 28(2) GDPR gives the buyer a right to object to changes. Fact: a processor may engage another processor only with the controller's prior specific or general written authorisation. Under a general authorisation, the processor informs the controller of intended additions or replacements and gives the opportunity to object.

Request the full list with each sub-processor's role, location and transfer mechanism. Typical DAM sub-processors include:

• Cloud hosting and storage providers, including backup regions.
• Content delivery networks that cache renditions worldwide.
• AI model providers used for auto-tagging, transcription and search.
• Support, ticketing, email and monitoring tools.

Ask where AI processing runs, because AI features can call a separate provider in a different region. Fact: Article 28(4) requires the same data protection obligations to flow down to each sub-processor, and the initial processor stays fully liable for them. For transfers outside the EEA, check the mechanism. Common mechanisms are the Commission's standard contractual clauses in Implementing Decision (EU) 2021/914. For certified US recipients, the EU-US Data Privacy Framework adequacy decision, Implementing Decision (EU) 2023/1795, applies. The data residency requirement should cover primary storage, backups and AI processing.

Penetration tests, incidents and continuity

Penetration tests, incident response and continuity plans show how the DAM vendor finds and handles failures. Request the executive summary of the latest independent penetration test, the remediation status of high and critical findings, and the test scope. DAMSelection rule of thumb: a test older than 12 months, or one that excluded the production application, needs a follow-up question.

Ask for four operational facts:

1. Recovery point objective and recovery time objective for the DAM service.
2. Backup frequency, retention and region.
3. Incident notification commitment in hours, matched to the data processing agreement.
4. Results date of the last disaster recovery test.

Buyers in scope of the NIS2 Directive have an extra duty. Fact: Article 21(2)(d) of Directive (EU) 2022/2555 requires essential and important entities to include supply chain security in their cybersecurity risk-management measures, covering relationships with direct suppliers and service providers. A DAM vendor is such a supplier, so the review record becomes part of that evidence.

Financial stability, ownership and insurance

Financial stability and ownership checks protect the buyer from a vendor that is sold, merged or underfunded during a five-year contract. DAMSelection assessment: DAM ownership changes often reset roadmaps, pricing policies and support teams, so the review records the ownership history.

Check four items:

• Annual accounts from the national company register, such as the Dutch Kamer van Koophandel or UK Companies House, for revenue trend and solvency.
• Ownership: private equity, strategic owner or founder-led, and any change in the last three years.
• Insurance certificates for cyber liability and professional indemnity, with cover amounts in line with the contract's liability caps.
• Continuity commitments for a change of control, such as a right to terminate with full export assistance.

The Vendor Pulse briefing tracks DAM ownership changes monthly. Vendor profiles in the DAM vendor directory list recorded ownership events with sources.

Start the review early

A DAM security review started at the shortlist stage finishes before negotiation, while one started after the decision delays signature. Vendors need time to share restricted documents, and internal reviewers work to their own queue.

Run the review across the checkpoints of the Selection Route:

1. Shortlist: send the security questionnaire with the RFP and ask for the certificate and sub-processor list. The Requirements Builder exports the security and platform requirements as a starting set.
2. Test: collect the SOC 2 report, penetration test summary and draft data processing agreement under NDA.
3. Score: score security, hosting and compliance from the documents and record open findings.
4. Sign: turn open findings into contract terms, deadlines or remediation commitments.

Record each finding with an owner and a status. Findings that remain open at signature belong in the contract, as the contract clauses checklist describes.