Workday Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Workday

1. 1

   REQUEST POST-BREACH DOCUMENTATION (Priority 1 — within 14 days): Contact Workday's security team and request their post-incident report for the August 2025 data breach. Ask specifically whether your organization's data was in scope, what data categories were affected, and what remediation steps were completed. This is the highest-priority action given the confirmed breach involves a platform handling sensitive HR and financial data.

2. 2

   OBTAIN AND REVIEW SOC 2 TYPE II REPORT (Priority 2 — within 30 days): Request Workday's current SOC 2 Type II report and a bridge letter covering the period since the last audit. SOC 2 compliance is claimed on their trust page at workday.com/en-us/why-workday/trust/compliance.html — contact their security team directly or submit a request via trust.workday.com. The report will confirm the scope, audit period, and any exceptions noted by the auditor.

   SOC 2 Overview (AICPA)How to Find Vendor Trust Pages
3. 3

   EXECUTE A DATA PROCESSING AGREEMENT (Priority 3 — before processing personal data): If your use case involves EU personal data, request and execute Workday's standard DPA before onboarding. This formalizes GDPR Article 28 obligations, subprocessor controls, and breach notification timelines. Workday is expected to have a standard DPA — ask your account manager or check trust.workday.com.

   GDPR Full TextDPA Template (GDPR Art. 28)
4. 4

   CLARIFY AI TRAINING DATA POLICY (Priority 4 — within 30 days): Request written confirmation from Workday's privacy or AI governance team on whether HR or employee data is used to train Workday AI models. Review workday.com/ai directly for the latest policy version. Given active AI bias litigation, document this response in your AI risk register.

5. 5

   MANUALLY REVIEW SUBPROCESSOR LIST (Priority 5 — within 30 days): Visit trust.workday.com/subprocessors in a browser to manually review Workday's published subprocessors. Cross-reference any subprocessors in high-risk jurisdictions against your data transfer policies. If the page requires authentication, request the subprocessor list directly from Workday's privacy team.

   GDPR Subprocessor Rules
6. 6

   VERIFY HITRUST CERTIFICATION STATUS (Priority 6 — within 45 days): The HITRUST certified entity directory could not be checked during this assessment. If HITRUST certification is relevant to your compliance requirements (e.g., healthcare adjacent data), verify directly with Workday's security team and request a copy of any current HITRUST assessment letter.

7. 7

   CONFIRM APPLICATION-LAYER SECURITY HEADERS (Priority 7 — within 45 days): The public marketing site received a failing HTTP Observatory grade. Verify independently that Workday's authenticated application URLs enforce HSTS, CSP, and X-Frame-Options. Use browser developer tools or securityheaders.com on your organization's Workday login URL to confirm — this takes less than five minutes and provides documentation for your vendor risk register.

   Check Security HeadersNIST Supply Chain Risk (SP 800-161)

• Web archive history was unavailable during this assessment, limiting the ability to independently verify the domain's historical presence beyond WHOIS registration data.
• Open threat exchange (OTX) pulse analysis was unavailable; community-sourced threat intelligence signals for workday.com could not be assessed.
• IP reputation scoring was unavailable during this assessment; abuse confidence data for Workday's primary IP (209.177.161.149) could not be retrieved.
• Website security scan data was unavailable, limiting dynamic analysis of workday.com's current page behavior and threat indicators.
• External cyber risk scoring was not available for this assessment; an independent quantitative security posture score could not be generated.
• Certificate Transparency log data (Certificate Transparency service) was partially unavailable; subdomain enumeration via CT logs could not be completed, and certificate data was sourced from direct TLS handshake only.
• The HITRUST certified entity directory could not be rendered during this investigation due to its JavaScript SPA architecture; HITRUST certification status should be verified directly with Workday.
• The subprocessor page at trust.workday.com/subprocessors was found but could not be parsed by automated tooling, leaving third-party supply chain composition unquantified in this assessment.