Vendor security assessment questionnaire template, free to send

Sort vendors before you send anything

Sending a questionnaire costs you time twice: once to send and chase, once to read. Spend that time only where the risk is. Rank vendors by what they can reach, not by the size of the invoice. A low-cost logging tool may see every request your app handles. An expensive furniture contract sees nothing. Three tiers are enough.

Keep the register current as you sign up new tools. Several requests on a SOC 2 evidence request list ask for exactly this: the vendor list, the assurance you collected and the risk review before data started flowing. Rebuilding that a year later is slow and error prone.

The 24 questions

Numbered straight through so you can send the whole list or split groups between owners. Each one can be answered with a sentence or a document name. None asks the vendor to describe a philosophy, because answers like that can never later turn out to be false.

A. The company

1. What is your registered legal name and country of registration?
2. Which of your products will we use, and what will it do with our data?
3. Who is your security contact, and how do we escalate?

B. Independent assurance

4. Do you have a current SOC 2 Type 2 report, and for what period?
5. Which criteria are in scope, and which vendors of yours are carved out?
6. If that period closed more than three months ago, will you provide a bridge letter?
7. When was your most recent penetration test, and may we see the summary?

C. Our data

8. Which kinds of our data will you hold, and in which countries?
9. How is our data encrypted in transit and at rest?
10. How do you keep our data separate from other customers’ data?
11. How long do you keep our data after we leave, and how do you confirm deletion?
12. Which of your staff can read our production data, and who approves that?

D. Access and change

13. Do all your staff use multi factor authentication for production?
14. Can our users sign in through our single sign on, and on which plan?
15. How fast do you remove access when one of your staff leaves?
16. How are production changes reviewed and approved?

E. Incidents and staff

17. Have you had a security incident involving customer data in the past two years?
18. How many hours or days after confirming a breach would you tell us?
19. Are staff with production access background checked?
20. How often do staff complete security training?

F. Subprocessors and recovery

21. Which subprocessors touch our data, and where is that list published?
22. How much notice do we get before you add one?
23. What are your recovery time and recovery point targets, and when did you last test a restore?
24. Do you hold cyber insurance, and what is the limit?

Questions to leave out

Cutting questions saves both sides time. Drop anything whose answer would not change your decision. Three examples:

• “Do you have a security policy?” Everyone says yes. Ask about the specific control instead, like question 15.
• “Describe your security culture.” No answer to it can ever be proven wrong, so it tells you nothing.
• Anything their report already answers. Read the report first rather than making them retype it into your form.

If they send a SOC 2 report instead

Good. A report holds evidence that a licensed CPA firm tested against set criteria.¹ A filled in form holds what the vendor says about itself. Take the report and do three things. First, check it is genuine and current: signer, period, scope and exceptions, using how to tell if a SOC 2 report is real. Second, read the complementary user entity controls. They are jobs assigned to you, and if you skip them the vendor’s controls may not hold.² The CUEC guide explains. Third, send only what the report leaves open, usually questions 8, 11, 14, 21 and 24, since a report covers the vendor’s system and not your contract. Then write a dated note of who read it and what they concluded. A report sitting in a folder proves nobody read it.

If a critical vendor has no report

That is not an automatic no. It means you gather assurance another way and record the decision. Get all 24 answers in writing from a named person, with a date. An email thread counts, a phone call does not. Ask for what they do have, like a pen test summary or an ISO 27001 certificate. Put the rest into the contract: a breach notice window in hours, a deletion duty, subprocessor notice and a right to re-assess. Finally, log the exception with the vendor, the gap, who accepted it and when you will look again. Your own examination tests your vendor management, so that record is what counts.

When to ask again

Follow the tier table, and time Tier 1 reviews to land after the vendor’s report period ends so you read fresh coverage. Four events pull a review forward: the vendor starts touching customer data and moves up a tier, its report lapses with no bridge letter, it announces a breach, or it adds a subprocessor that handles your data.

Free template, or tracked for you

Sending this questionnaire costs nothing. Keeping a register current, with dated review notes, is the part that slips as the vendor list grows. The cybersoftware software generates the register and tracks each review and its evidence, at $199 a month, cancel any time. Try the free readiness assessment first, or compare plans on pricing.

cybersoftware is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.