Free template · Excel + Markdown · For buyers
Vendor security questionnaire template
A vendor security questionnaire is a list of questions a company sends a supplier to find out how the supplier protects data before trusting it with any. This template gives you 37 original, plain-English questions across 16 domains, from governance and access control to incident response, subprocessors and AI use, with Yes, No, Partial and Not applicable answers, a comment column and a list of the evidence to ask for.
Updated Oct 2026
Download the Vendor security questionnaire template
37 plain-English questions with a Lite tier, answer dropdowns and an evidence checklist.
Direct download, no form. Works in Word, Google Docs and LibreOffice Writer. The Markdown copy is plain text for wikis, Notion or an AI assistant.
What it is and when to use it
Use the Lite tier (16 questions) for low-risk suppliers that never touch sensitive data, and the full set for vendors that store or process customer or regulated data. If your industry or a regulator expects a standard questionnaire, use that instead: the SIG from Shared Assessments and the CAIQ from the Cloud Security Alliance are the common ones, and many vendors keep a completed copy ready. Vendors can also use this file the other way round, as a self-assessment before the real questionnaires arrive.
Use it when
- You need to assess a new supplier and have no standard questionnaire of your own yet.
- You want a short, readable screen for low-risk vendors instead of sending everyone hundreds of questions.
- You sell software and want to rehearse your answers and evidence before customers ask.
Skip it when
- A regulator, auditor or customer contract specifies a standard (SIG, CAIQ, HECVAT or a sector questionnaire).
- The vendor already publishes a completed SIG or CAIQ, or a trust center that answers your questions: review that first.
What is inside the template
The workbook opens on an Instructions sheet, followed by 3 working sheets: Vendor profile, Questionnaire, Evidence checklist. Shaded cells are inputs; cells marked Auto below are formulas.
Sheet: Vendor profile
Requester fills the scope rows; the vendor fills the rest.
| Field | Response |
|---|---|
| Vendor legal name | |
| Service or product in scope | |
| Types of data the vendor will access (requester) | |
| Approximate number of records or users (requester) |
Preview shows 4 of 9 pre-filled rows.
Sheet: Questionnaire
Answer every row in the tier requested. Comment on every Partial, No and Not applicable. Attach or link evidence where requested.
| ID | Domain | Tier | Question | Answer | Comment or compensating control | Evidence requested | Evidence provided (file or link) |
|---|---|---|---|---|---|---|---|
| SQ-01 | Governance | Lite | Do you maintain a written information security policy approved by management and reviewed at least annually? | Policy document or table of contents | |||
| SQ-02 | Governance | Lite | Is a named person or team accountable for information security? | Name and title | |||
| SQ-03 | Governance | Lite | Do you hold a current ISO/IEC 27001 certificate or SOC 2 Type II report covering the service in scope? | Certificate or report, with scope and period | |||
| SQ-04 | Risk management | Full | Do you perform a documented information security risk assessment at least annually? | Date of last assessment |
Preview shows 4 of 37 pre-filled rows.
Sheet: Evidence checklist
Record the period or expiry date of each document so the next review knows when to ask again.
| Document | Requested | Received | Report period or expiry | Reviewer notes |
|---|---|---|---|---|
| SOC 2 Type II report (with bridge letter if the period has ended) | ||||
| ISO/IEC 27001 certificate and Statement of Applicability | ||||
| Penetration test executive summary (last 12 months) | ||||
| Information security policy (or table of contents) |
Preview shows 4 of 11 pre-filled rows.
How to fill it in, section by section
Vendor profile
Captures who the vendor is, what service is in scope and what data it will touch.
- Fill the scope fields before sending: which service, which data types and how many records. Scope decides which tier to send.
- Ask the vendor to name the person responsible for security answers.
Questionnaire: tier column
Marks which questions belong to the 17-question Lite screen and which only to the full assessment.
- For a low-risk vendor, filter Tier to Lite and send only those rows.
- Add your own rows at the bottom for requirements specific to your industry, keeping the ID sequence.
Questionnaire: answers and comments
Where the vendor answers each question and explains anything other than a plain Yes.
- Require a comment for every Partial and No. A bare No tells you less than a No with a compensating control.
- Not applicable needs a reason too, for example "fully cloud-hosted, no own facilities".
Questionnaire: evidence
Lists the proof that backs each answer, so claims can be checked rather than trusted.
- Ask for evidence on the questions that matter most to your risk, not all of them. Reviewing 37 attachments is nobody’s best week.
- Record the date of each document: a penetration test from three years ago is not current evidence.
Evidence checklist
Tracks which standard documents you requested, received and reviewed.
- Mark what you need based on the data in scope. A SOC 2 Type II or ISO 27001 certificate can answer many questions at once.
- Note the report period or expiry date so the next review knows when to ask again.
Common mistakes
Sending the full set to every supplier
A catering vendor does not need questions about secure code review. Tiering by the data in scope keeps the questionnaire answerable and keeps your reviewers focused on vendors that carry real risk.
Accepting Yes without evidence
A Yes on encryption at rest with no description of how is a claim, not an answer. Ask for the evidence on the handful of questions that would hurt most if the answer were wrong.
Ignoring what the vendor already publishes
Many vendors keep a completed SIG or CAIQ, a SOC 2 report or a trust center. Reviewing those first can answer most of your questions without another spreadsheet round trip.
Asking two questions in one row
"Do you encrypt data and rotate keys annually?" gets a Yes that may only cover the first half. One question per row, one answer per question.
Never re-assessing
Answers age. Set a review date by risk tier and ask for updated evidence when reports expire or the vendor adds subprocessors.
Tools that automate parts of this
This directory covers the vendor side: tools that help suppliers answer security questionnaires quickly and consistently. If you are the buyer sending the questionnaire, these are what your better-prepared vendors are using.
- 1U
1up: Automates RFPs, DDQs and security questionnaires and auto-fills web-based questionnaires, with a free tier.
- IR
Iris: Browser extension that fills security questionnaire portals such as OneTrust and Vanta, with a cited source on each answer.
- LO
Loopio: Handles security questionnaires from the same tagged, versioned library as RFPs and DDQs.
- RO
RocketDocs: RFPs, DDQs and security questionnaires from one approved library, with private AI that the vendor says runs in its own environment.
Capabilities above are restated from each vendor’s profile, where the sources are listed. Confirm current features and pricing with the vendor before you buy.
Related pages
Sources
- Shared Assessments: What is the SIG? (checked October 2026)
- Cloud Security Alliance: Cloud Controls Matrix and CAIQ (checked October 2026)
- Cloud Security Alliance: STAR levels (checked October 2026)
Frequently asked questions
What is a vendor security questionnaire?
It is a set of questions a company sends a supplier to assess how the supplier protects data and systems, usually covering policies, access control, encryption, incident response, business continuity, subprocessors and privacy. It is a core step in third-party or vendor risk management.
Should I use this template or the SIG or CAIQ?
Use a standard when a regulator, contract or your risk team expects one, or when the vendor already has a completed copy. The SIG is published by Shared Assessments and the CAIQ by the Cloud Security Alliance. This template suits teams that need a shorter, plain-English questionnaire, especially for lower-risk vendors.
Is the SIG questionnaire free?
No. Shared Assessments states the SIG is not free to download: it is available to its members and through an annual subscription, and it describes the SIG as being updated at least annually.
Is the CAIQ free?
The Cloud Security Alliance publishes the CAIQ as part of the Cloud Controls Matrix, which it says can be used without a license for internal purposes. Cloud providers can submit a completed CAIQ to the STAR Registry as a STAR Level 1 self-assessment, which CSA describes as complimentary.
How many questions should a security questionnaire have?
Enough to cover the risk, and no more. This template has 16 Lite questions for low-risk vendors and 37 in total. Use a longer standard questionnaire, such as the SIG Core, only for high-risk relationships.
Can vendors use software to answer security questionnaires?
Yes. Response tools draft answers from a library of approved answers and policies, and some fill web-based questionnaire portals directly. A person on the security team should still approve answers before they go out.