# Vendor Security Questionnaire Template

> Free template from RFP Software Tools (https://rfp-software-tools.com/templates/vendor-security-questionnaire-template). No sign-up. The Excel version has dropdowns and formulas; this Markdown copy shows the same structure.

## How to use it

| Area | What it is for | How to fill it |
| --- | --- | --- |
| Vendor profile | Captures who the vendor is, what service is in scope and what data it will touch. | Fill the scope fields before sending: which service, which data types and how many records. Scope decides which tier to send. Ask the vendor to name the person responsible for security answers. |
| Questionnaire: tier column | Marks which questions belong to the 17-question Lite screen and which only to the full assessment. | For a low-risk vendor, filter Tier to Lite and send only those rows. Add your own rows at the bottom for requirements specific to your industry, keeping the ID sequence. |
| Questionnaire: answers and comments | Where the vendor answers each question and explains anything other than a plain Yes. | Require a comment for every Partial and No. A bare No tells you less than a No with a compensating control. Not applicable needs a reason too, for example "fully cloud-hosted, no own facilities". |
| Questionnaire: evidence | Lists the proof that backs each answer, so claims can be checked rather than trusted. | Ask for evidence on the questions that matter most to your risk, not all of them. Reviewing 37 attachments is nobody’s best week. Record the date of each document: a penetration test from three years ago is not current evidence. |
| Evidence checklist | Tracks which standard documents you requested, received and reviewed. | Mark what you need based on the data in scope. A SOC 2 Type II or ISO 27001 certificate can answer many questions at once. Note the report period or expiry date so the next review knows when to ask again. |

## Sheet: Vendor profile

Requester fills the scope rows; the vendor fills the rest.

| Field | Response |
| --- | --- |
| Vendor legal name |  |
| Service or product in scope |  |
| Types of data the vendor will access (requester) |  |
| Approximate number of records or users (requester) |  |
| Tier requested: Lite or Full (requester) |  |
| Security contact name, title and email |  |
| Trust center or security page URL |  |
| Completed standard questionnaire available (SIG, CAIQ, other)? |  |
| Date completed |  |

## Sheet: Questionnaire

Answer every row in the tier requested. Comment on every Partial, No and Not applicable. Attach or link evidence where requested.

| ID | Domain | Tier | Question | Answer | Comment or compensating control | Evidence requested | Evidence provided (file or link) |
| --- | --- | --- | --- | --- | --- | --- | --- |
| SQ-01 | Governance | Lite | Do you maintain a written information security policy approved by management and reviewed at least annually? |  |  | Policy document or table of contents |  |
| SQ-02 | Governance | Lite | Is a named person or team accountable for information security? |  |  | Name and title |  |
| SQ-03 | Governance | Lite | Do you hold a current ISO/IEC 27001 certificate or SOC 2 Type II report covering the service in scope? |  |  | Certificate or report, with scope and period |  |
| SQ-04 | Risk management | Full | Do you perform a documented information security risk assessment at least annually? |  |  | Date of last assessment |  |
| SQ-05 | Asset management | Full | Do you maintain an inventory of systems that store or process customer data? |  |  |  |  |
| SQ-06 | Access control | Lite | Is multi-factor authentication required for all workforce access to production systems and administrative consoles? |  |  |  |  |
| SQ-07 | Access control | Lite | Does the product support single sign-on for customer users (for example SAML 2.0 or OpenID Connect)? |  |  | Supported protocols |  |
| SQ-08 | Access control | Full | Is access to customer data granted on least privilege and reviewed at least quarterly? |  |  | Access review record |  |
| SQ-09 | Access control | Full | Are workforce accounts removed within one business day of a leaver’s departure? |  |  |  |  |
| SQ-10 | Data protection | Lite | Is customer data encrypted in transit using TLS 1.2 or higher? |  |  |  |  |
| SQ-11 | Data protection | Lite | Is customer data encrypted at rest? Describe the algorithm and key management. |  |  |  |  |
| SQ-12 | Data protection | Lite | In which countries or regions is customer data stored and processed, including backups? |  |  | Hosting regions |  |
| SQ-13 | Data protection | Full | Can customers export their data, and is it deleted within a defined period after contract end? |  |  | Retention and deletion policy |  |
| SQ-14 | Data protection | Full | Is customer data logically separated from other customers’ data? |  |  | Architecture description |  |
| SQ-15 | Application security | Full | Do you follow a secure development process that includes code review before release? |  |  |  |  |
| SQ-16 | Application security | Full | Do you run automated security testing (for example static analysis or dependency scanning) on the codebase? |  |  |  |  |
| SQ-17 | Application security | Lite | Has an independent third party performed a penetration test of the product in the last 12 months? |  |  | Executive summary of the latest test |  |
| SQ-18 | Infrastructure | Lite | Which cloud or hosting providers run the production environment? |  |  |  |  |
| SQ-19 | Infrastructure | Full | Are production environments separated from development and test environments? |  |  |  |  |
| SQ-20 | Vulnerability management | Full | Do you scan for vulnerabilities at least monthly and remediate critical findings within a defined timeframe? |  |  | Remediation SLA by severity |  |
| SQ-21 | Logging and monitoring | Full | Are security-relevant events logged centrally and retained for a defined period? |  |  | Retention period |  |
| SQ-22 | Logging and monitoring | Full | Are alerts monitored and triaged, including outside business hours? |  |  |  |  |
| SQ-23 | Incident response | Lite | Do you have a documented incident response plan that has been tested in the last 12 months? |  |  | Plan or test summary |  |
| SQ-24 | Incident response | Lite | Within what time will you notify customers of a security incident affecting their data? |  |  | Contractual notification period |  |
| SQ-25 | Business continuity | Full | Do you maintain business continuity and disaster recovery plans, tested at least annually? |  |  | Last test date and results |  |
| SQ-26 | Business continuity | Full | What are your recovery time and recovery point objectives for the service? |  |  | RTO and RPO |  |
| SQ-27 | Business continuity | Full | Are backups encrypted, stored separately from production and restored in tests? |  |  |  |  |
| SQ-28 | Third parties | Lite | Do you publish or provide a current list of subprocessors that may access customer data? |  |  | Subprocessor list |  |
| SQ-29 | Third parties | Full | Do you assess the security of your own critical suppliers before onboarding and periodically after? |  |  |  |  |
| SQ-30 | Privacy | Lite | Will you sign a data processing agreement, and does it cover international transfers where relevant? |  |  | DPA template |  |
| SQ-31 | Privacy | Full | Do you have a process to support data subject requests (access, correction, deletion)? |  |  |  |  |
| SQ-32 | Human resources | Full | Do employees and contractors complete security awareness training at onboarding and at least annually? |  |  | Training completion rate |  |
| SQ-33 | Human resources | Full | Are background checks performed where permitted by local law for staff with access to customer data? |  |  |  |  |
| SQ-34 | Physical security | Full | If you operate your own facilities, how is physical access to systems with customer data controlled? If fully cloud-hosted, say so. |  |  |  |  |
| SQ-35 | AI use | Lite | Does the service use AI or machine-learning models to process customer data? If so, which providers and for what purpose? |  |  | AI use statement |  |
| SQ-36 | AI use | Lite | Is customer data used to train or fine-tune models shared with other customers or third parties? |  |  |  |  |
| SQ-37 | AI use | Full | Can customers opt out of AI features or of their data being retained by AI subprocessors? |  |  |  |  |

Dropdown values:

- **Tier:** Lite / Full
- **Answer:** Yes / No / Partial / Not applicable

## Sheet: Evidence checklist

Record the period or expiry date of each document so the next review knows when to ask again.

| Document | Requested | Received | Report period or expiry | Reviewer notes |
| --- | --- | --- | --- | --- |
| SOC 2 Type II report (with bridge letter if the period has ended) |  |  |  |  |
| ISO/IEC 27001 certificate and Statement of Applicability |  |  |  |  |
| Penetration test executive summary (last 12 months) |  |  |  |  |
| Information security policy (or table of contents) |  |  |  |  |
| Incident response plan or summary |  |  |  |  |
| Business continuity and disaster recovery test summary |  |  |  |  |
| Subprocessor list |  |  |  |  |
| Data processing agreement |  |  |  |  |
| Cyber insurance certificate |  |  |  |  |
| Architecture or data-flow diagram |  |  |  |  |
| Completed SIG or CAIQ, if the vendor has one |  |  |  |  |

Dropdown values:

- **Requested:** Yes / No
- **Received:** Yes / No / Under NDA