Vendor security assessment questionnaire template, free to send

Sort vendors before you send anything

Sending a questionnaire costs you time twice: once to send and chase, once to read. Spend that time only where the risk is. Rank vendors by what they can reach, not by the size of the invoice. A low-cost logging tool may see every request your app handles. An expensive furniture contract sees nothing. Three tiers are enough.

Keep the register current as you sign up new tools. Several requests on a SOC 2 evidence request list ask for exactly this: the vendor list, the assurance you collected and the risk review before data started flowing. Rebuilding that a year later is slow and error prone.

The 24 questions

Numbered straight through so you can send the whole list or split groups between owners. Each one can be answered with a sentence or a document name. None asks the vendor to describe a philosophy, because answers like that can never later turn out to be false.

A. Company and scope

1. What is your legal entity name, and where is the company registered?
2. Which of your products will we use, and what does it do with our data?
3. Who is the named security contact, and what is the escalation address?

B. Assurance

4. Do you hold a current SOC 2 Type 2 report, and what period does it cover?
5. Which criteria are in scope, and which subservice organizations are carved out?
6. If that period ended over three months ago, can you send a bridge letter?
7. When was your last penetration test, and can we see the summary?

C. Our data

8. What categories of our data will you store, and in which countries?
9. Is our data encrypted in transit and at rest, and with what?
10. How is our data separated from another customer’s inside your systems?
11. What is your retention period after termination, and how is deletion confirmed?
12. Which of your staff can read our production data, and who approves that?

D. Access and change

13. Is multi factor authentication enforced for every employee on your production console?
14. Do you offer single sign on to our users, and at which plan level?
15. How is access removed when an employee leaves, and within how long?
16. How are production changes reviewed and approved before they ship?

E. Incidents and people

17. Have you had a security incident affecting customer data in the last 24 months?
18. How fast do you notify us after confirming a breach, in hours or days?
19. Do you run background checks on staff with production access?
20. Do staff complete security training, and how often?

F. Subprocessors and continuity

21. Which subprocessors handle our data, and where is that list published?
22. How much notice do we get before a new subprocessor is added?
23. What are your recovery time and recovery point targets, and when was the last restore test?
24. Do you carry cyber liability insurance, and at what limit?

Questions to leave out

Cutting questions saves both sides time. Drop anything whose answer would not change your decision. Three examples:

• “Do you have a security policy?” Everyone says yes. Ask about the specific control instead, like question 15.
• “Describe your security culture.” No answer to it can ever be proven wrong, so it tells you nothing.
• Anything their report already answers. Read the report first rather than making them retype it into your form.

If they send a SOC 2 report instead

Good. A report holds evidence that a licensed CPA firm tested against set criteria.¹ A filled in form holds what the vendor says about itself. Take the report and do three things. First, check it is genuine and current: signer, period, scope and exceptions, using how to tell if a SOC 2 report is real. Second, read the complementary user entity controls. They are jobs assigned to you, and if you skip them the vendor’s controls may not hold.² The CUEC guide explains. Third, send only what the report leaves open, usually questions 8, 11, 14, 21 and 24, since a report covers the vendor’s system and not your contract. Then write a dated note of who read it and what they concluded. A report sitting in a folder proves nobody read it. The spreadsheet has a review record sheet for that note. The vendor management policy sets the tiers, the review intervals and the contract terms around all of this.

If a critical vendor has no report

That is not an automatic no. It means you gather assurance another way and record the decision. Get all 24 answers in writing from a named person, with a date. An email thread counts, a phone call does not. Ask for what they do have, like a pen test summary or an ISO 27001 certificate. Put the rest into the contract: a breach notice window in hours, a deletion duty, subprocessor notice and a right to re-assess. Finally, log the exception with the vendor, the gap, who accepted it and when you will look again. Your own examination tests your vendor management, so that record is what counts.

When to ask again

Follow the tier table, and time Tier 1 reviews to land after the vendor’s report period ends so you read fresh coverage. Four events pull a review forward: the vendor starts touching customer data and moves up a tier, its report lapses with no bridge letter, it announces a breach, or it adds a subprocessor that handles your data.

Free template, or tracked for you

Sending this questionnaire costs nothing. Keeping a register current, with dated review notes, is the part that slips as the vendor list grows. cybersoftware keeps the register and tracks each review and its evidence. Onboarding is $2,000 one time, or $4,000 one time with a Security scoped SOC 2 Type 1 examination and the independent partner auditor fee included. Try the free readiness assessment first, or see every price on pricing.

cybersoftware is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.