Vendor Security Questionnaire Template with Scoring

Get a copy

Drop your details, grab the template.

What's inside

Format: XLSX
Category: Vendor
Price: Free

Asurvo customers get this template preloaded in their workspace, along with hundreds of other starter documents.

See Asurvo in action Browse all templates

Vendor due diligence

Asking vendors the right security questions, and scoring the answers

A vendor security questionnaire is a means to a decision: can we trust this supplier with this data or this function, and on what conditions? Questionnaires fail when they become a ritual, sent identically to every vendor, returned full of yes answers, and filed without anyone reading them. This template gives you a starting structure with scoring. The guidance below covers which domains to ask about, how to weight answers, when to skip the questionnaire, and how to spot answers that deserve a follow-up call.

Question domains and what good answers look like

Domain, Example question, Strong answer includes comparison
Domain	Example question	Strong answer includes
Governance and certifications	Which independent attestations or certifications cover the service you provide to us?	Current SOC 2 Type II or ISO 27001 certificate whose scope includes the specific service and locations
Data handling	What of our data do you store, where, and for how long after termination?	Named data categories, hosting regions, retention and deletion commitments
Access control	How is access to customer data restricted and reviewed?	Least privilege, MFA, periodic access reviews, logged administrative access
Encryption	How is data protected in transit and at rest, and who manages the keys?	Modern TLS, encryption at rest, a described key management approach
Vulnerability management	How often are you penetration tested, and how fast are critical findings fixed?	Independent testing on a regular cycle with defined remediation timelines
Incident response	How and how quickly will you notify us of an incident affecting our data?	A contractual notification window and a named contact route
Business continuity	What are your recovery objectives for the service, and when were they last tested?	Stated RTO and RPO with a recent test date
Subprocessors	Which subprocessors handle our data, and how are we told about changes?	A published list and a change notification process
Personnel security	Do staff with access to customer data complete background checks and security training?	Screening where lawful, onboarding and annual training, confidentiality agreements

Add domains when the service warrants it: secure development for software vendors, model training and data use for AI providers, physical security for data center or logistics suppliers, and privacy obligations such as GDPR Article 28 processor terms where personal data is involved.

Scoring that reflects what matters

Flat scoring, where every yes earns one point, rewards vendors for volume rather than for the controls that protect you. A more useful model has three layers:

Knockout questions. A small set where a wrong answer stops approval pending remediation or exception, such as no MFA on administrative access to customer data, or no commitment to notify you of breaches.
Weighted domains. Weight domains by relevance to the engagement. Data handling and access control might carry the most weight for a SaaS vendor holding customer data; continuity carries more for a payments processor.
Answer quality. Score partial or conditional answers between full and zero, and give credit only for evidence-backed answers on high-weight questions.

Illustrative outcome bands

Illustrative outcome bands
Weighted result	Outcome	Typical next step
Any knockout failed	Not approved	Remediation commitment or formal risk acceptance by the business owner
High score, evidence provided	Approved	Standard contract terms; reassess on the tier's cycle
Mid-range score	Approved with conditions	Contract clauses, compensating controls, or a remediation deadline
Low score	Escalate	Security review call, alternative vendor evaluation, or risk acceptance

Scale the questionnaire to the vendor tier

Sending the full question set to a vendor that never touches your data wastes both sides' time and trains vendors to answer carelessly. Use your vendor tiering model to decide depth: a short form for low-risk vendors, the core set for moderate risk, and the full set plus evidence review for critical vendors. The vendor risk program guide covers how intake, tiering, and assessment connect.

Reviewing a SOC 2 report or ISO certificate properly

The service and systems you use are within the report or certificate scope
The SOC 2 period is recent; request a bridge letter covering the gap to today
Exceptions noted by the auditor are read and assessed, not skipped
Subservice organizations that were carved out are identified, since their controls are not tested in the report
Complementary user entity controls are listed and assigned to owners on your side
ISO certificates come from an accredited certification body, are in date, and the statement of applicability is available on request

Red flags worth a follow-up

Every answer is yes, including questions that do not apply to the service.
Policies are offered as evidence for operational questions, such as a policy document in response to asking for last access review results.
A certification is claimed but the scope covers a different product or entity.
Vague incident notification commitments, such as notifying 'promptly' with no contractual backing.
Refusal to name subprocessors that will hold your data.

Framework requirements for supplier assessment

ISO/IEC 27001:2022 Annex A 5.19 through 5.22 require processes for supplier security, security requirements in supplier agreements, ICT supply chain risk, and monitoring supplier services, with 5.23 covering cloud services. SOC 2 CC9.2 addresses assessing and managing vendor risk. NIST CSF 2.0 covers this under GV.SC, cybersecurity supply chain risk management. PCI DSS 4.0.1 Requirement 12.8 expects due diligence before engaging service providers and monitoring their compliance status at least once every 12 months. HIPAA requires business associate agreements under §164.308(b). The third-party risk glossary entry defines the broader discipline.

Asurvo's Third Party product brings vendor inventory, tiering, questionnaires, risk scoring, and continuous monitoring together, so a questionnaire result becomes part of the vendor's risk record rather than an attachment in someone's inbox.

FAQ

Frequently asked questions

How many questions should a vendor security questionnaire have?

Enough to support the decision for that vendor's risk tier. Critical vendors may warrant a comprehensive set across all domains, while low-risk vendors may need only a short form. Asking every vendor everything slows procurement and lowers answer quality, so tie questionnaire depth to your tiering model.

Can a SOC 2 report replace a security questionnaire?

Often partially. A current SOC 2 Type II report covering the relevant service provides independently tested evidence for many domains. Review the scope, exceptions, carved-out subservice organizations, and complementary user entity controls, then send targeted questions only for gaps such as data residency or AI data use.

What are SIG and CAIQ?

The SIG is a standardized third-party risk questionnaire maintained by Shared Assessments. The CAIQ, or Consensus Assessments Initiative Questionnaire, is published by the Cloud Security Alliance and aligns with its Cloud Controls Matrix. Many vendors keep completed versions ready, which can shorten assessments when the scope matches your needs.

How should vendor questionnaire answers be scored?

Use knockout questions for non-negotiable controls, weight domains by relevance to the engagement, and give partial credit for conditional answers. Require evidence for high-weight answers. Translate the result into outcome bands such as approved, approved with conditions, escalate, or not approved, each with a defined next step.

How often should vendors be reassessed?

Base it on tier. Critical vendors are commonly reassessed annually, moderate vendors every one to two years, and low-risk vendors at renewal or on material change. Also reassess after a vendor security incident, a significant change in the service, or when they gain access to more sensitive data.

Keep exploring

Vendor Security Questionnaire