Log In Start free trial
Free template · updated

Vendor security assessment questionnaire (free template)

A security questionnaire you can send to a SaaS vendor or supplier today: numbered questions grouped by area, a short Lite version for low-risk vendors, the framework each area maps to, and a CSV with answer and evidence columns.

See the 75 questions Download CSV

Short answer: a vendor security assessment questionnaire (often just "security questionnaire") is how you check a supplier before it gets your data. This template has 75 questions in 14 areas – governance and certifications, subprocessors, people, access, encryption, development, infrastructure, vulnerability management, logging, incidents, continuity, privacy, AI and physical security. The 31 questions marked Lite are the short version for low-risk vendors. Every area shows the NIST CSF 2.0 categories and CSA Cloud Controls Matrix domains it relates to.

The questions are our own wording. Only the topic areas follow public frameworks (sources at the bottom); nothing is copied from the licensed SIG or CAIQ questionnaires.

How to use it

  1. Tier the vendor. No access to personal or confidential data: send the Lite questions. Stores your customer data or runs a critical process: send the full version and ask for evidence.
  2. Ask for the SOC 2 Type II report or ISO 27001 certificate first. If it is current and covers the product you are buying, only send the questions it does not answer (usually data location, subprocessors, breach notification time, deletion at exit and AI use).
  3. Require evidence for every Lite question – a policy, a report page, a screenshot of a setting. The CSV has Answer, Evidence and Notes columns.
  4. Score and decide. Yes / Partial / No / N/A, weighted by what the vendor will do for you. Record accepted risks and the review date (at least yearly for critical vendors).

Vendor security questionnaire – 14 areas, 75 questions

Mapping: NIST CSF 2.0 categories · CSA CCM v4.1 domains. LITE = in the short version.

1. Governance, policies and certifications

NIST CSF 2.0: GV.OC, GV.RR, GV.PO, GV.OV · CCM: GRC, A&A

  1. 1.1Who is accountable for information security (name and role), and does that person report to executive management?LITE
  2. 1.2Do you have a written information security policy approved by management and reviewed at least once a year?LITE
  3. 1.3Which independent certifications or attestation reports cover the service in scope (for example SOC 2 Type II, ISO/IEC 27001), and what is the audit period or expiry date of each?LITE
  4. 1.4Does the scope of those reports cover the exact product, hosting locations and teams that will serve us?
  5. 1.5Did the latest audit report any exceptions, qualified opinions or major nonconformities, and how were they fixed?LITE
  6. 1.6Can you provide a bridge letter covering the time between the end of your last SOC 2 period and today?
  7. 1.7Do you keep a security risk register and carry out a risk assessment at least once a year?
  8. 1.8Do you hold cyber insurance? State the insurer and the coverage limit.

2. Third parties and subprocessors

NIST CSF 2.0: GV.SC · CCM: STA

  1. 2.1List the subprocessors that store or process our data, with their country and purpose.LITE
  2. 2.2Which cloud hosting providers and regions run the service?LITE
  3. 2.3How do you assess the security of your own critical suppliers before onboarding them and during the relationship?
  4. 2.4Will you notify us before adding or replacing a subprocessor, and with how much notice?LITE
  5. 2.5Do your contracts with subprocessors include security and confidentiality obligations at least as strict as ours?

3. People security

NIST CSF 2.0: PR.AT, GV.RR · CCM: HRS

  1. 3.1Are employees and contractors background-checked, where the law allows, before they get access to customer data?LITE
  2. 3.2Do all staff complete security awareness training (including phishing) when they join and at least once a year?LITE
  3. 3.3Do employees and contractors sign confidentiality agreements?
  4. 3.4How quickly is access removed when someone leaves or changes role (target time)?
  5. 3.5Do engineers with production access receive secure-coding or role-specific security training?

4. Identity and access management

NIST CSF 2.0: PR.AA · CCM: IAM

  1. 4.1Is multi-factor authentication enforced for all staff access to production, source code, e-mail and admin consoles?LITE
  2. 4.2Is access to customer data granted on least privilege and reviewed at least every quarter?LITE
  3. 4.3Do workforce accounts go through single sign-on and one central identity provider?
  4. 4.4Are privileged (administrator) accounts separate from everyday accounts, and is their use logged?
  5. 4.5Are shared or generic accounts forbidden, or controlled and attributable to a person?
  6. 4.6Does the product offer our users SSO (SAML or OIDC), MFA and role-based permissions?LITE
  7. 4.7How are API keys, secrets and service credentials stored and rotated?

5. Data protection and encryption

NIST CSF 2.0: PR.DS · CCM: DSP, CEK, UEM

  1. 5.1Is our data encrypted in transit (which TLS versions) and at rest (which algorithm)?LITE
  2. 5.2Who manages the encryption keys, and can customers bring or control their own keys?
  3. 5.3In which countries is our data stored and processed – including backups and support access?LITE
  4. 5.4How is our data separated from other customers' data, and how is that separation tested?
  5. 5.5How and when is our data returned and deleted at the end of the contract, including backups, and do you confirm deletion in writing?LITE
  6. 5.6Do you classify data and apply handling rules by classification?
  7. 5.7Is production data ever used in development or test environments? If so, how is it masked?
  8. 5.8Are staff laptops encrypted, centrally managed and able to be wiped remotely?

6. Application and change security

NIST CSF 2.0: PR.PS, ID.IM · CCM: AIS, CCC

  1. 6.1Do you follow a documented secure development lifecycle, with peer code review before changes are merged?LITE
  2. 6.2Do you run automated security testing in the build pipeline (static analysis, dependency scanning, dynamic testing)?
  3. 6.3Are production changes approved, tested and traceable, with emergency changes reviewed afterwards?LITE
  4. 6.4How do you track open-source dependencies and their known vulnerabilities? Can you produce a software bill of materials (SBOM)?
  5. 6.5Are development, staging and production environments separated?

7. Infrastructure and network security

NIST CSF 2.0: PR.IR, PR.PS · CCM: IVS, UEM

  1. 7.1Are production systems hardened against a documented baseline (for example CIS Benchmarks)?LITE
  2. 7.2How is network access to production restricted (firewall rules, private networks, bastion or zero-trust access)?
  3. 7.3How do you protect the service against denial-of-service attacks?
  4. 7.4Are operating systems and infrastructure components patched on a defined schedule? What is it?
  5. 7.5Is malware or endpoint detection running on staff devices and, where relevant, servers?

8. Vulnerability management and penetration testing

NIST CSF 2.0: ID.RA, ID.IM · CCM: TVM

  1. 8.1Does an independent third party penetration-test the application and infrastructure at least once a year? Can you share the executive summary?LITE
  2. 8.2What are your remediation deadlines by severity (critical, high, medium), and do you meet them?LITE
  3. 8.3Do you run authenticated vulnerability scans of your infrastructure at least monthly?
  4. 8.4Do you publish a vulnerability disclosure policy or run a bug bounty?
  5. 8.5Are any critical or high findings from the last penetration test still open? If so, what compensating controls are in place?

9. Logging and monitoring

NIST CSF 2.0: DE.CM, DE.AE · CCM: LOG

  1. 9.1Are security events (logins, admin actions, access to customer data) logged centrally and protected from tampering?LITE
  2. 9.2How long are security logs kept?
  3. 9.3Are alerts monitored around the clock, by your own team or a managed detection (MDR/SOC) provider?
  4. 9.4Can our administrators see an audit log of activity in our own account?LITE
  5. 9.5Are system clocks synchronised to a reliable time source?

10. Incident response and breach notification

NIST CSF 2.0: RS.MA, RS.AN, RS.CO, RS.MI · CCM: SEF

  1. 10.1Do you have a documented incident response plan, tested at least once a year (for example a tabletop exercise)?LITE
  2. 10.2Within how many hours will you notify us of a security incident that affects our data, and through which channel?LITE
  3. 10.3In the last 36 months, have you had a security incident or personal data breach that you had to report to customers or regulators?LITE
  4. 10.4Do you preserve evidence and carry out a root-cause analysis after incidents? Will you share the report with affected customers?
  5. 10.5Who is our security contact during an incident, and how do we reach them out of hours?

11. Business continuity and disaster recovery

NIST CSF 2.0: RC.RP, RC.CO, PR.IR · CCM: BCR

  1. 11.1What are the recovery time objective (RTO) and recovery point objective (RPO) for the service?LITE
  2. 11.2Are backups encrypted, kept in a separate location or account, and restore-tested at least once a year?LITE
  3. 11.3Is the service deployed across several availability zones or regions?
  4. 11.4When was the business continuity and disaster recovery plan last tested, and what did the test find?
  5. 11.5What availability do you commit to in the SLA, and where is your uptime history published?

12. Privacy and data protection

NIST CSF 2.0: GV.OC · CCM: DSP

  1. 12.1Will you sign a data processing agreement that covers the terms of GDPR Article 28 (yours or ours)?LITE
  2. 12.2Which transfer mechanism applies when our data leaves the EEA or UK (adequacy decision, Standard Contractual Clauses, EU-US Data Privacy Framework)?LITE
  3. 12.3Who is your data protection officer or privacy lead, and how do we contact them?
  4. 12.4How do you help us answer data subject requests (access, correction, deletion) for our users?
  5. 12.5Do you keep records of processing activities for the service?

13. AI and use of customer data

NIST CSF 2.0: GV.PO, GV.SC · CCM: DSP, STA

  1. 13.1Does the service send our data to AI models – your own or a third party's? Which providers?LITE
  2. 13.2Are our data, prompts or outputs used to train or improve any model? Can that be excluded in the contract?LITE
  3. 13.3Can our administrators switch AI features off?
  4. 13.4How long do AI providers keep our data, and are they on your subprocessor list?

14. Physical security

NIST CSF 2.0: PR.AA, PR.IR · CCM: DCS

  1. 14.1Is our data processed only in data centres whose physical controls are covered by an independent report (for example the cloud provider's SOC 2 or ISO 27001)?
  2. 14.2Do offices with access to customer data have access control and visitor management?
  3. 14.3How are devices and storage media disposed of securely?
Full questionnaire (CSV) Lite version (CSV)

The CSV opens in Excel, Numbers or Google Sheets, with columns for the answer, evidence and notes. A practical starting point, not legal or audit advice.

Who sends it

Security, procurement and privacy teams before onboarding a SaaS tool, outsourcing provider or any supplier that will hold personal or confidential data – and again at renewal.

Typical timeline

A few days for a Lite review with a SOC 2 report attached; two to six weeks for a critical vendor with follow-up questions and evidence.

Red flags
  • No independent report or certification for a vendor that will hold your data
  • SOC 2 scope that excludes the product you are buying
  • MFA not enforced for staff with production access
  • No commitment to a breach-notification time
  • Unknown subprocessors or data stored in unexpected countries
  • Penetration test older than 12 months, or critical findings still open
  • Customer data used to train AI models with no opt-out
  • No written deletion process at contract end

Are you the vendor answering it?

Fill this questionnaire in once and put it next to your SOC 2 report, ISO 27001 certificate and penetration test summary in one room. Prospects sign your NDA online before anything opens, read view-only with their e-mail watermarked on every page, and lose access on the date you set – and you see who read what. Your whole team, unlimited guests, one price. Or $199 for a single deal. No sales call.

Share security documents under NDA How NDA before access works

Frameworks this template is based on

FrameworkWhat we used
NIST Cybersecurity Framework (CSF) 2.0Published 26 February 2024. Six functions – Govern (GV), Identify (ID), Protect (PR), Detect (DE), Respond (RS), Recover (RC) – and their categories (e.g. PR.AA identity and access control, GV.SC supply-chain risk). Free and public.
CSA Cloud Controls Matrix (CCM) v4.1 and CAIQ197 control objectives in 17 domains (A&A, AIS, BCR, CCC, CEK, DCS, DSP, GRC, HRS, IAM, IPY, IVS, LOG, SEF, STA, TVM, UEM); the CAIQ is the yes/no questionnaire built on it. Free for internal use; commercial use needs a CSA licence, so we map to domains only.
Shared Assessments SIG (Lite and Core)The Standardized Information Gathering questionnaire, widely used in financial services. It is a licensed product: we only used its broad risk areas (governance, third parties, access, application security, incident management, resilience, privacy) as a checklist of topics – no SIG questions are reproduced.
ISO/IEC 27001:2022, Annex A93 controls in four themes: organisational, people, physical and technological. Ask for the certificate and the Statement of Applicability rather than re-asking every control.
AICPA SOC 2 – Trust Services CriteriaSecurity (required), availability, processing integrity, confidentiality and privacy. A recent SOC 2 Type II report answers most questions in areas 1–11; use the questionnaire for the gaps.

Framework details checked on 7 November 2026. SIG, CAIQ and ISO are trademarks of their owners; this template is not endorsed by them.

FAQ

Security questionnaires – questions

What is a vendor security assessment questionnaire?

A list of questions a company sends to a supplier before sharing data with it or relying on its service. It covers governance and certifications, subprocessors, people, access control, encryption, secure development, vulnerability management, logging, incident response, continuity, privacy and – increasingly – AI. The answers and evidence feed the vendor risk assessment.

Is a vendor risk assessment questionnaire the same thing?

Mostly. "Vendor risk assessment questionnaire" is the broader term: besides security it may cover financial health, compliance, ESG and operations. This template is the security part; for company, financial and contract checks use the vendor due diligence checklist and combine the two.

Should I use the Lite or the full version?

Tier your vendors first. Low-risk vendors with no access to personal or confidential data: the Lite questions are enough. Vendors that store customer data or run a critical process: the full version plus evidence (SOC 2 report, ISO 27001 certificate, penetration test summary).

Do I need a questionnaire if the vendor has a SOC 2 report?

Ask for the report first. A current SOC 2 Type II report with no relevant exceptions answers most of areas 1–11, so send only the questions it does not cover – typically data location, subprocessors, breach notification time, deletion at exit and AI use. Check that the report's scope matches the product you are buying and read the complementary user entity controls.

How is this different from SIG or CAIQ?

SIG (Shared Assessments) and CAIQ (Cloud Security Alliance) are standard questionnaires with hundreds of questions; SIG is licensed and CAIQ needs a licence for commercial use. This template is shorter, written in plain English and free to use – each area lists the NIST CSF 2.0 categories and CCM domains it relates to, so you can line answers up with a vendor's completed CAIQ or SIG.

How should answers be scored?

Use Yes / Partial / No / Not applicable, require evidence for every Lite question, and weight areas by what the vendor will do for you – a payroll provider's data protection answers matter more than its physical security. A "No" on MFA, encryption, breach notification or deletion at exit is usually a blocker for vendors that hold personal data.

Can I use and edit this template?

Yes – copy it, edit it and send it to your vendors. It is a practical starting point, not legal or audit advice; adapt it to your regulator's expectations (for example DORA or NIS2 for EU financial and essential entities).

Related
Vendor due diligence checklist (documents) Share SOC 2 reports under NDA NDA before access All due diligence checklists