Last updated: 28 October 2026

A vendor risk assessment questionnaire is a structured set of questions you send to a supplier before (and during) the relationship to find out how it protects your data, keeps its service running and meets its legal obligations. The best questionnaires are tiered: a short set for low-risk vendors, a longer set for vendors that touch sensitive data, and a full set for critical suppliers. Below are 60 ready-to-use questions split into those three tiers, each paired with the evidence you should ask for.

This guide is the companion to our vendor risk assessment guide, which covers tiering, scoring and the end-to-end process. Here we focus on what to actually ask.

Why one questionnaire for every vendor fails

Most free templates are a single flat list of 20 to 50 questions. That causes two problems:

  • Low-risk vendors get buried. A catering supplier with no system access does not need to answer questions about encryption key management. Long questionnaires sent to low-risk suppliers slow procurement and get ignored.
  • Critical vendors get let off lightly. A cloud provider hosting your customer database needs far more scrutiny than a generic list provides, especially if you are subject to DORA, NIS2 or GDPR.

A tiered approach fixes both. Every vendor answers the core questions; the standard and critical sets are added only when the vendor's tier calls for it.

Tier Typical vendors Questions to send Expected turnaround
Tier 3 (low) No access to systems or personal data; easily replaceable Core set (Q1 to Q15) Days
Tier 2 (medium) Access to internal systems or limited personal data Core + Standard (Q1 to Q40) 1 to 3 weeks
Tier 1 (high / critical) Sensitive or large volumes of personal data, supports a critical business function, hard to replace Core + Standard + Critical (Q1 to Q60) 3 to 6 weeks, plus evidence review

The tier boundaries and turnaround times above are a common-practice starting point, not a legal standard. Adjust them to your own risk appetite. If you have not tiered your vendors yet, start with the inherent risk scoring model in our vendor risk assessment guide.

What the law expects you to check

A questionnaire is not a legal requirement in itself, but several laws require you to assess suppliers before you rely on them. Your questions should produce the evidence those laws expect.

Law or standard What it requires Questions that cover it
GDPR Article 28(1) Controllers may use only processors "providing sufficient guarantees to implement appropriate technical and organisational measures" Q6 to Q15, Q16 to Q30
GDPR Article 28(3)(a) to (h) Contract terms covering instructions, confidentiality, security, sub-processors, assistance with rights requests, deletion or return of data, and audits Q12, Q13, Q31 to Q36
POPIA sections 19 to 21 (South Africa) The responsible party must ensure, through a written contract, that an operator establishes and maintains the security measures in section 19, and the operator must notify it of suspected compromises Q9, Q11, Q14, Q31
NIS2 Article 21(2)(d) and 21(3) Supply chain security measures that take into account each direct supplier's specific vulnerabilities, the overall quality of its products and cybersecurity practices, and its secure development procedures Q24, Q25, Q41 to Q48
DORA Article 28(4) (EU financial entities) Before contracting for ICT services, assess whether the service supports a critical or important function, identify and assess all relevant risks including concentration risk, carry out due diligence and assess conflicts of interest Q1 to Q5, Q49 to Q56
ISO/IEC 27001:2022 Annex A 5.19 to 5.22 Controls for information security in supplier relationships, supplier agreements, the ICT supply chain and monitoring of supplier services Whole questionnaire

Note that DORA applies to EU financial entities and has applied since 17 January 2025. NIS2 is a directive, so the exact obligations depend on each EU member state's transposing law. In South Africa, POPIA calls a processor an "operator" and a controller a "responsible party". If you work through POPIA, our POPIA compliance guide explains the operator rules in more detail.

Core questions: send to every vendor (Q1 to Q15)

These 15 questions establish who the vendor is, what it will touch, and whether basic controls are in place. For Tier 3 vendors, a satisfactory answer to these is usually enough.

Company and service profile

# Question Evidence to request
1 What is your registered legal name, company number, country of incorporation and ultimate parent company? Company registration extract
2 Describe the service you will provide to us and the business process it supports. Service description or statement of work
3 In which countries will the service be delivered and supported, including support staff locations? Location list
4 Have you experienced any material litigation, regulatory action or insolvency proceedings in the last three years? Signed declaration
5 Who is your named security and privacy contact for this relationship? Name, role and email

Data and access

# Question Evidence to request
6 Will you access, store, transmit or otherwise process our personal data or confidential information? If yes, which categories? Data inventory for the service
7 Will you process any special category or sensitive personal data (for example health, biometric or financial data)? Data inventory
8 Will your staff or systems need access to our network, systems or premises? Describe the access method. Access description
9 Where will our data be stored and processed (countries and hosting providers)? Hosting and location list
10 How long will you retain our data, and how is it deleted or returned at the end of the contract? Retention and deletion procedure

Baseline controls

# Question Evidence to request
11 Do you have a documented information security policy approved by management and reviewed at least annually? Policy table of contents and approval date
12 Are all staff with access to customer data bound by confidentiality obligations? Template confidentiality clause
13 Do you use sub-processors or subcontractors to deliver this service? If yes, list them. Sub-processor list
14 Do you have a documented incident response process, and within what timeframe will you notify us of a security incident affecting our data? Incident response policy extract
15 Do you hold any current independent certifications or attestations (for example ISO/IEC 27001 or a SOC 2 Type II report)? Certificate with scope and expiry date, or report

Red flags at this stage: unable to name a security contact, cannot say where data is stored, no incident notification commitment, or a certification whose scope does not cover the service you are buying.

Standard questions: add for medium and high-risk vendors (Q16 to Q40)

These questions test whether controls actually operate. Ask for evidence rather than accepting yes or no answers.

Identity and access management

# Question Evidence to request
16 Is multi-factor authentication enforced for all remote access and for all administrative accounts? Configuration screenshot or policy extract
17 How do you grant, review and remove user access? How often are access reviews performed? Access review record (redacted)
18 How quickly is access revoked when an employee leaves? Joiner-mover-leaver procedure
19 How are privileged accounts managed and monitored? Privileged access policy

Data protection

# Question Evidence to request
20 Is our data encrypted in transit and at rest? Which protocols and standards do you use? Encryption standard or architecture summary
21 Who manages the encryption keys, and how is access to them controlled? Key management procedure
22 Is our data logically separated from other customers' data? Architecture description
23 Do you use our data for any purpose other than providing the service, including product improvement or training AI models? Contract clause or written confirmation

Vulnerability and change management

# Question Evidence to request
24 How often do you run vulnerability scans, and what are your remediation timeframes by severity? Patch management policy
25 When was your last independent penetration test, and have all critical and high findings been fixed? Executive summary or remediation letter
26 Do you follow a documented secure software development process, including code review and security testing? Secure development policy
27 How are changes to production systems approved and tested? Change management procedure

Monitoring and incident response

# Question Evidence to request
28 Do you centrally log and monitor security events? How long are logs retained? Logging standard
29 Have you had a security incident or personal data breach in the last 24 months that affected customer data? Signed declaration and summary
30 When did you last test your incident response plan? Tabletop exercise record

Privacy and contract terms

# Question Evidence to request
31 Will you sign a data processing agreement (or operator agreement under POPIA) that covers the terms required by applicable law? Your standard DPA
32 Will you process our personal data only on our documented instructions? DPA clause
33 How will you help us respond to data subject requests (access, correction, deletion) within legal deadlines? DSR support procedure
34 How do you notify us before adding or replacing a sub-processor, and can we object? Sub-processor change clause
35 If data is transferred outside its country of origin, which transfer mechanism do you rely on? Transfer mechanism and, where relevant, a transfer impact assessment
36 Will you allow us, or an auditor we appoint, to audit your compliance, or provide equivalent reports? Audit clause

Resilience

# Question Evidence to request
37 Do you have a business continuity and disaster recovery plan covering this service? Plan summary
38 What are your recovery time and recovery point objectives for this service? RTO and RPO statement
39 How often are backups taken and restore tests performed? Last restore test result
40 What is your contracted service availability, and how is it reported? SLA and recent availability report

What good looks like: evidence that is dated within the last 12 months, scoped to the service you are buying, and consistent across answers. An incident response policy that promises 72-hour notification is weak if your own regulatory deadline is also 72 hours; ask for a shorter window.

Critical vendor questions: add for Tier 1 (Q41 to Q60)

Critical vendors support functions you cannot run without, or hold data whose loss would cause serious harm. These questions cover supply chain depth, exit, concentration risk and AI use, which are the areas generic templates miss.

Supply chain (fourth parties)

# Question Evidence to request
41 Which of your own suppliers are critical to delivering this service? Critical supplier list
42 How do you assess and monitor the security of those suppliers? Your third-party risk procedure
43 Do you flow down equivalent security and data protection obligations to your subcontractors? Template subcontractor clause
44 Which cloud or hosting providers underpin the service, and in which regions? Infrastructure diagram
45 Do you maintain a software bill of materials or equivalent inventory of third-party components? Inventory extract or policy
46 How do you manage vulnerabilities in open-source and third-party components? Dependency management policy
47 Has any critical supplier of yours had an incident in the last 24 months that affected your service? Signed declaration
48 How do you verify the integrity of software updates you ship to customers? Release and code-signing process

Concentration, exit and continuity

# Question Evidence to request
49 Can the service be delivered from more than one region or data centre? Architecture description
50 What is your documented exit plan, and in what format and timeframe will you return our data? Exit plan and data export format
51 Will you provide transition assistance if the contract ends, and for how long? Contract clause
52 How do you notify customers of a change of control, major restructuring or financial distress? Contract clause
53 Please provide your latest audited financial statements or credit report. Financial statements
54 Do you hold cyber and professional indemnity insurance? What are the limits? Insurance certificate
55 Will you participate in our business continuity or resilience testing where required? Written confirmation
56 Have you identified any conflicts of interest relevant to this engagement? Signed declaration

AI and automated processing

# Question Evidence to request
57 Does the service use AI or machine learning features that process our data? Describe them. AI feature description
58 Which third-party AI models or providers are used, and is our data retained or used for training by them? AI sub-processor list and data use terms
59 Can AI features be disabled or configured for our account? Product documentation
60 How do you test AI outputs for accuracy, bias and security issues such as prompt injection, and who is accountable? AI governance policy

If you are an EU financial entity, Q49 to Q56 also feed the information you need for your DORA register of information under Article 28(3), which requires a register of all contractual arrangements for ICT services provided by ICT third-party service providers.

SIG, CAIQ or your own questionnaire?

Two industry questionnaires are widely used, and you may receive completed versions from vendors instead of your own.

SIG CAIQ Custom tiered questionnaire
Owner Shared Assessments Cloud Security Alliance You
Focus Broad third-party risk across many domains Cloud service providers, aligned to the Cloud Controls Matrix Your risks and regulations
Scoping SIG Lite for lower-risk third parties, SIG Core for higher-risk ones; annual release cycle Yes or no questions mapped to CCM controls; the current CCM v4.1 has 207 controls across 17 domains Tiered by vendor risk
Access Licensed to Shared Assessments members and subscribers Free to download from CSA Free
Best for Large programmes, financial services Assessing SaaS and cloud vendors Small and mid-sized teams, mixed vendor portfolios

A practical approach: accept a completed SIG or CAIQ, or a current SOC 2 Type II report, as evidence for the questions it covers, then send only the remaining questions from your own set. This respects the vendor's time and gets you answers faster.

How to run the questionnaire: step by step

  1. Tier the vendor first. Use the inherent risk factors (data sensitivity, system access, business criticality, replaceability) to decide which question sets to send. Record the tier in your vendor risk register.
  2. Check what evidence already exists. Ask for any SOC 2 report, ISO/IEC 27001 certificate, SIG or CAIQ before sending questions. Remove questions already answered.
  3. Send with a deadline and a contact. Give a realistic deadline (see the tier table above) and name who will answer queries.
  4. Score each answer. A simple scale works: 0 = no control, 1 = partial or undocumented, 2 = in place with evidence. Weight questions that map to legal requirements more heavily.
  5. Review evidence, not just answers. Check dates, scope and consistency. A SOC 2 report that excludes the service you are buying does not count.
  6. Log gaps as findings. Each gap should become a tracked issue with an owner, a remediation date, and a decision: fix, accept, or add a compensating contract term.
  7. Decide and document. Approve, approve with conditions, or reject. Record who made the decision and why.
  8. Reassess on a schedule. Common practice is annual for critical vendors, every two years for medium risk, and on material change (new service, breach, acquisition) for all.

Worked example: scoring a SaaS payroll provider

A mid-sized company is onboarding a cloud payroll provider. It will hold employee names, bank details and salary data, and payroll cannot run without it. That makes it Tier 1: all 60 questions apply.

The vendor supplies a current SOC 2 Type II report and a completed CAIQ. The assessor maps these to the questionnaire and finds that 38 questions are already answered with evidence. The remaining 22 are sent, mostly from the privacy, exit and AI sections.

Results after review:

Area Score (out of 2 per question) Finding
Access management (Q16 to Q19) 8 of 8 MFA enforced, quarterly access reviews evidenced
Data protection (Q20 to Q23) 6 of 8 Q23: terms allow use of "aggregated data" for product improvement; scope unclear
Incident response (Q14, Q28 to Q30) 6 of 8 Q14: notification within 72 hours is too slow for the company's own deadlines
Exit (Q50, Q51) 2 of 4 Q51: no contractual transition assistance
AI (Q57 to Q60) 5 of 8 Q58: uses a third-party AI provider for a support chatbot; data retention terms not provided

Decision: approve with conditions. The contract is amended to require notification within 24 hours, to define and limit aggregated data use, and to include 90 days of transition assistance. The AI provider's data terms are requested within 30 days and tracked as an open issue.

Common mistakes

  • Accepting "yes" without evidence. A yes or no answer tells you what the vendor believes, not what it does.
  • Sending the full set to every vendor. This trains suppliers to rush answers and wastes your reviewers' time.
  • Ignoring sub-processors. Your data is only as safe as the weakest supplier in the chain. GDPR Article 28 and NIS2 Article 21(3) both point you there.
  • No follow-up on gaps. A questionnaire with unresolved findings gives a false sense of assurance.
  • Never reassessing. Vendors change ownership, infrastructure and AI features. Annual review for critical vendors is the minimum most programmes use.
  • Skipping the contract. Several gaps are best closed in the contract, not the questionnaire. Align your questions with your data processing agreement.

Frequently asked questions

What should a vendor risk assessment questionnaire include?

At minimum: the vendor's identity and service, what data and systems it will access, where data is stored, its security policies, access controls, encryption, incident response and notification commitments, sub-processors, business continuity, and certifications. Critical vendors should also be asked about fourth parties, exit plans, financial stability and AI use.

How many questions should a vendor security questionnaire have?

It depends on the vendor's risk. Around 15 questions is enough for low-risk suppliers, 40 for medium risk, and 60 or more for critical vendors. Industry questionnaires such as SIG Core are much longer and are usually scoped down before use.

Is the SIG questionnaire free?

No. The SIG is licensed by Shared Assessments to its members and subscribers. The Cloud Security Alliance's CAIQ, which is aligned to the Cloud Controls Matrix, is available to download from the CSA website.

How often should vendors complete a risk assessment questionnaire?

Common practice is annually for critical vendors, every one to two years for medium-risk vendors, and at onboarding plus on material change for low-risk vendors. Some regulations, such as DORA for EU financial entities, also expect ongoing monitoring of ICT third-party risk rather than one-off checks.

Can a SOC 2 report replace a questionnaire?

Partly. A current SOC 2 Type II report provides independent evidence for many security controls, but it does not cover everything, such as your specific contract terms, data locations, exit arrangements or AI use. Use it to reduce the questionnaire, not replace it.

Who should review vendor questionnaire responses?

Security reviews technical controls, privacy or legal reviews data processing and contract terms, and the business owner confirms the service and criticality. For critical vendors, procurement or finance should review financial stability and insurance.

Run tiered questionnaires in Core GRC

Core GRC's third-party risk management module lets you tier vendors, send the right question set automatically, collect evidence in one place and turn gaps into tracked issues in your risk and issue registers. Core IQ, the platform's agentic AI, helps review vendor responses and evidence so your team can focus on the decisions. Explore the modules or follow our guide to adding your first vendor.

Cover photo by Zulfugar Karimov on Unsplash