Vendor Security Questionnaire Template

A vendor security questionnaire helps you decide whether a supplier can be trusted with your data or service. Keep it proportionate: low-risk suppliers need a short version, critical ones need the full set plus evidence.

Ask for evidence wherever it exists, such as an ISO 27001 certificate with its scope, a SOC 2 report or a penetration test summary. A "yes" without evidence is a claim, not an assurance.

How to use this template

1. Tier the vendor by the data it will access and how critical the service is.
2. Send section 1 to every vendor and the full questionnaire to high and critical vendors.
3. Request the evidence listed in the last column.
4. Score answers, record gaps and agree remediation or contract clauses before signing.
5. Repeat the review for critical vendors at least yearly.

The template

# Vendor Security Questionnaire

**Vendor:** [Name]  |  **Service:** [Description]  |  **Data accessed:** [Types]  |  **Tier:** [Low / Medium / High / Critical]
Answer Yes / No / Partly and attach evidence where requested.

## 1. Governance and certifications
1. Do you have an information security policy approved by management? (Evidence: policy table of contents)
2. Is there a named person accountable for information security?
3. Do you hold ISO/IEC 27001 certification? Please state the scope. (Evidence: certificate)
4. Do you have a current SOC 2 Type 2 or equivalent independent report? (Evidence: report or bridge letter)
5. Do staff complete security awareness training at least yearly?
6. Do you carry out background checks on staff with access to customer data, where lawful?

## 2. Access control
7. Is MFA enforced for all staff access to systems holding customer data?
8. Is access granted on least privilege and reviewed at least quarterly?
9. Are privileged accounts separate, restricted and logged?
10. Is access removed within one business day when staff leave?
11. Is single sign-on available for customer accounts?

## 3. Data protection
12. Where will our data be stored and processed (countries and providers)?
13. Is our data encrypted in transit (TLS 1.2 or later) and at rest?
14. Is our data logically separated from other customers' data?
15. Do you use our data to train AI models? If yes, can we opt out?
16. How long do you keep our data, and how is it deleted at contract end?
17. Will you sign a data processing agreement meeting GDPR Article 28?
18. Which sub-processors will access our data? How are we told about changes?
19. What safeguards cover transfers outside the EEA, such as Standard Contractual Clauses?

## 4. Application and infrastructure security
20. Do you follow a secure development life cycle with code review?
21. Is an independent penetration test performed at least yearly? (Evidence: summary)
22. How quickly are critical vulnerabilities patched?
23. Are production systems monitored with centralised logging and alerting?
24. Is endpoint protection deployed on all staff devices?
25. Are development, test and production environments separated?

## 5. Incident response and breach notification
26. Do you have a documented and tested incident response plan?
27. How quickly will you notify us of a security incident affecting our data?
28. Have you had a security breach affecting customer data in the last 24 months? Please describe.
29. Will you support our own breach investigations and regulatory notifications?

## 6. Resilience
30. Are backups taken, encrypted, stored separately and restore-tested?
31. What are your recovery time and recovery point objectives for this service?
32. Do you have a tested business continuity plan?
33. What is your uptime commitment, and is it in the contract?

## 7. Third parties and supply chain
34. How do you assess the security of your own critical suppliers?
35. Do you maintain a software bill of materials or dependency inventory for this service?

## 8. Compliance
36. Which laws and standards do you comply with for this service (for example GDPR, PCI DSS, HIPAA)?
37. Will you allow audits or provide audit reports on request?
38. Do you have cyber insurance?
39. Are there any open audit findings relevant to this service?
40. Who is our security contact, and how can they be reached?

## Reviewer section
| Area | Rating (Low / Medium / High risk) | Notes and required actions |
| --- | --- | --- |
| Governance | | |
| Access | | |
| Data protection | | |
| Security operations | | |
| Incidents | | |
| Resilience | | |
**Decision:** [Approve / Approve with conditions / Reject]  |  **Reviewer:** [Name]  |  **Date:** [YYYY-MM-DD]  |  **Next review:** [YYYY-MM-DD]

Frequently asked questions

Related

• Vendor risk assessment services
• ISO 27001 Annex A 5.19 Supplier relationships
• 10-point GDPR compliance checklist
• Information Security Policy Template
• Acceptable Use Policy Template
• GDPR Data Breach Log Template