Insights · Template
Vendor security assessment questionnaire
A questionnaire documents what a vendor says; the evidence column is what makes it an assessment. This template lists the sections to ask about and, for each, the artifact to request from vendors whose failure would be consequential.
How to use it
Before the first step.
- Classify the vendor by consequence first; request evidence in proportion.
- Read the evidence. A questionnaire filed unread is not oversight.
Steps
Each one owned and evidenced.
| # | Step | Owner | Evidence |
|---|---|---|---|
| 01 | Organization and scope: services provided, data accessed, systems connected, subcontractors used. | Vendor | Service description and sub-processor list |
| 02 | Governance: security policy, named security owner, risk management process. | Vendor | Policy and organization chart |
| 03 | Certifications and attestations: ISO/IEC 27001, SOC 2 Type II, sector-specific. | Vendor | Certificate or report under NDA |
| 04 | Identity and access: MFA coverage, privileged access control, leaver process. | Vendor | Configuration evidence or audit extract |
| 05 | Data handling: classification, encryption at rest and in transit, residency, retention, deletion. | Vendor | Data handling statement and evidence |
| 06 | Vulnerability and patch management: scanning, timelines by severity, recent test summary. | Vendor | Program description and test summary |
| 07 | Monitoring and incident response: detection coverage, response plan, notification commitments. | Vendor | Plan extract and notification clause |
| 08 | Business continuity and recovery: objectives, tested recovery, last test date. | Vendor | Test record |
| 09 | Incident history: breaches and significant incidents in the past three years and their handling. | Vendor | Disclosure statement |
| 10 | AI use: AI features in the service, data used for training, vendor models relied on. | Vendor | AI disclosure |
| 11 | Contractual commitments: security addendum, audit rights, insurance, exit and data return. | Vendor with procurement | Contract terms |
| 12 | Assessment outcome: rating, conditions, register entry and review date. | Assessor | Completed register entry |
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days