Free vendor security questionnaire template
Answer three questions about a vendor and get a security questionnaire sized to its risk: short for low-risk vendors, thorough for the ones that hold your data or connect to your systems.
Why size the questionnaire to the vendor?
Sending the same 300-question spreadsheet to every vendor wastes everyone’s time: small vendors give up or answer carelessly, and your team cannot review it all. Risk-based tiering asks low-risk vendors a handful of questions and saves the full review for the vendors that hold sensitive data, connect to your systems or keep your business running.
How the risk tier is decided
- Data: the more sensitive the data the vendor sees, the higher the risk. Health, financial and identity data always put a vendor in Tier 1.
- Access: administrator rights or a connection into your network let a vendor’s security problem become yours. A network connection always means Tier 1.
- Criticality: how much an outage at the vendor would hurt your operations or customers.
What a good vendor questionnaire covers
Governance and certifications, access control, data protection and privacy, infrastructure and operations, application security, incident response and continuity, and the vendor’s own subcontractors and people. Add health or payment card questions when the vendor touches that data. Ask for evidence on the answers that matter most, not only yes or no.
Accepting SOC 2 or ISO 27001 instead
A current SOC 2 Type 2 report or ISO 27001 certificate already covers many general controls. Accepting it instead of those questions makes the review faster for both sides. Check the scope and dates, read the exceptions in a SOC 2 report, and still ask the questions that are specific to your data and the service.
Frequently asked questions
Is this vendor questionnaire template free?
Yes. Build and download as many questionnaires as you like, as PDF or as a CSV to send to vendors, without creating an account.
Is this the same as CAIQ, SIG or HECVAT?
No. Those are standard questionnaires published by other organisations. This builder uses its own questions and keeps them proportionate to the vendor’s risk; many vendors who have completed a standard questionnaire can answer it quickly from that work.
How often should vendors be reassessed?
A common practice is every year for Tier 1, every two years for Tier 2, and when the scope of the service changes for Tier 3. Reassess sooner after an incident or a major change at the vendor.
Is my information uploaded?
No. The questionnaire is built in your browser. If you add your contact details and download it, Sourceably saves those details so our team can help you, unless you tick "Don’t contact me".