Vendor Security Assessment Questionnaire
Generates a pre-contract due-diligence questionnaire for evaluating vendor security controls, data practices, and compliance across GDPR, CCPA, HIPAA, SOX, GLBA, FERPA, and industry frameworks.
Quick Start
Gather before drafting:
- Vendor scope — data types accessed (PII, PHI, PCI, financial, proprietary), processing activities, data flows
- Applicable regulations — GDPR, CCPA, HIPAA, SOX, GLBA, FERPA, or sector-specific
- Risk tolerance — what constitutes acceptable vs. disqualifying vendor risk
- Contract alignment — security provisions to incorporate by reference
Document Framework
| Element |
Requirement |
| Preamble |
Completion mandatory pre-contract; responses are binding representations |
| Executive certification |
Senior officer (CISO/CTO/CLO) attests accuracy; signature block required |
| Submission deadline |
10–15 business days |
| Change notification |
Vendor notifies within 5 business days of material security changes |
| Confidentiality |
Questionnaire and responses treated as confidential business information |
Assessment Domains
Draft numbered questions per domain. Each question includes a response field and evidence-request field where applicable. Tailor scope to data sensitivity — not every vendor needs every domain.
1. Information Security Governance
- Dedicated CISO/equivalent; certifications (CISSP, CISM, CISA)
- Framework alignment (NIST CSF, ISO 27001, CIS Controls, COBIT)
- Policy review cadence; security awareness training (all-staff + specialized)
- Board-level security reporting frequency
2. Data Classification & Lifecycle
- Classification taxonomy compatibility with client's scheme
- All data storage/processing locations (primary, DR, backup, cloud regions)
- Cross-border transfer mechanisms (SCCs, adequacy decisions, BCRs)
- Retention post-termination; destruction methods; certificates of destruction
- Backup frequency; encrypted backup media; tested RTO/RPO
3. Access Control & Privileged Access
- MFA enforcement across all access; supported factors
- RBAC, least-privilege, segregation of duties
- Privileged access: JIT elevation, session recording, auto-deprovisioning
- Access recertification frequency; anomalous-access alerting
4. Vulnerability Management & Testing
- Scanning tools, frequency, and patching SLAs:
| Severity |
Patch SLA |
| Critical |
≤ 24–72 hrs |
| High |
≤ 7 days |
| Medium |
≤ 30 days |
| Low |
≤ 90 days |
- Annual third-party pentests (external + internal lateral movement)
- AppSec testing (SAST, DAST, SCA) for custom software
- Bug bounty / responsible disclosure program
- Request most recent pentest summary and remediation status
5. Incident Response & Business Continuity
- Documented IR plan with roles, escalation, communication protocols
- IR testing frequency (tabletop, simulations) and recent results
- Notification timeline — must allow client to meet most restrictive regulatory deadline (GDPR 72 hrs, HIPAA 60 days, state breach laws)
- Cooperation with client IR team and legal counsel
- Cyber insurance: policy limits, third-party liability, adequacy for data volume
- BCP/DR: tested RTO/RPO, geographic diversity, multi-scenario resilience
6. Encryption & Key Management
- At rest: minimum AES-256; scope includes production, dev/test, backups, portable media
- Database encryption approach (TDE, column-level, application-layer)
- In transit: TLS versions, deprecated protocol status, enforced cipher suites
- In use: confidential computing / secure enclave capabilities (if applicable)
- Key management: HSM/KMS storage, rotation frequency, secure destruction
7. Network Security & Segmentation
- Customer isolation; production vs. corporate separation
- Zero-trust architecture status
- Perimeter controls: firewalls, IDS/IPS, WAF, DDoS protection
- Remote access: VPN, NAC/device posture, MFA
- Assessment cadence (external scans, internal pentests, wireless)
8. Subprocessor Risk Management
- Complete subprocessor inventory: role, data access, location, assessments conducted
- Flow-down of security requirements (contractually at least as stringent as client's)
- Client notification and approval rights before new subprocessor engagement
- Right to terminate non-compliant subprocessors
9. Certifications & Compliance
- SOC 2 Type II: report date, principles, opinion status, scope alignment
- ISO 27001: certificate dates, scope, certification body
- PCI DSS, FedRAMP/StateRAMP, HITRUST, TISAX (as applicable)
- Regulatory compliance confirmation for applicable data types
- Commitment to provide updated reports/certifications annually
10. Physical Security & Environmental Controls
- Data center access: MFA, visitor logs, surveillance, security personnel
- Background checks for personnel with physical access
- Environmental: fire suppression, UPS, generators, climate, water detection
- Facility certifications (SSAE 18 SOC 1, Uptime Institute tier)
11. HR Security & Insider Threat
- Background checks; periodic re-investigation for sensitive roles
- Security training before access; policy acknowledgment
- Offboarding: access revocation timeline, exit procedures
- Insider threat monitoring; DLP for exfiltration prevention
Risk Assessment Framework
Score vendor responses after receipt:
| Rating |
Criteria |
| Low |
Controls meet/exceed requirements; evidence provided |
| Moderate |
Minor gaps; addressable via contractual provisions |
| High |
Significant gaps; requires remediation plan with deadlines |
| Critical |
Fundamental deficiencies; disqualifying absent remediation |
Assessment report must include:
- Per-domain and overall risk rating with justification
- Recommended contractual controls (audit rights, insurance minimums, SLAs)
- Evidence gaps requiring follow-up
- Go/no-go recommendation with conditions
- Flagged inconsistencies between responses and publicly available information
Checks
- State explicitly in preamble: responses are contractually binding representations; incomplete/misleading answers constitute grounds for disqualification or material breach
- Align notification timelines with the most restrictive applicable breach notification law
- Mark questions as required vs. conditional based on data type (PCI questions only if payment data involved)
- Flag vendors refusing to disclose subprocessors or share certifications as elevated risk
- All legal citations to specific regulatory provisions must be verified against current law [VERIFY]
1---2name: vendor-security-assessment3description: Drafts a Vendor Security Assessment Questionnaire evaluating third-party cybersecurity posture, data handling, and regulatory compliance. Vendor responses become binding contractual representations with executive certification. Use during vendor due diligence, third-party risk management, procurement security review, or subprocessor evaluation.4---5
6# Vendor Security Assessment Questionnaire
7
8Generates a pre-contract due-diligence questionnaire for evaluating vendor security controls, data practices, and compliance across GDPR, CCPA, HIPAA, SOX, GLBA, FERPA, and industry frameworks.
9
10## Quick Start
11
12Gather before drafting:
131. **Vendor scope** — data types accessed (PII, PHI, PCI, financial, proprietary), processing activities, data flows
142. **Applicable regulations** — GDPR, CCPA, HIPAA, SOX, GLBA, FERPA, or sector-specific
153. **Risk tolerance** — what constitutes acceptable vs. disqualifying vendor risk
164. **Contract alignment** — security provisions to incorporate by reference
17
18## Document Framework
19
20| Element | Requirement |
21|---|---|
22| Preamble | Completion mandatory pre-contract; responses are binding representations |
23| Executive certification | Senior officer (CISO/CTO/CLO) attests accuracy; signature block required |
24| Submission deadline | 10–15 business days |
25| Change notification | Vendor notifies within 5 business days of material security changes |
26| Confidentiality | Questionnaire and responses treated as confidential business information |
27
28## Assessment Domains
29
30Draft numbered questions per domain. Each question includes a response field and evidence-request field where applicable. Tailor scope to data sensitivity — not every vendor needs every domain.
31
32**1. Information Security Governance**
33- Dedicated CISO/equivalent; certifications (CISSP, CISM, CISA)
34- Framework alignment (NIST CSF, ISO 27001, CIS Controls, COBIT)
35- Policy review cadence; security awareness training (all-staff + specialized)
36- Board-level security reporting frequency
37
38**2. Data Classification & Lifecycle**
39- Classification taxonomy compatibility with client's scheme
40- All data storage/processing locations (primary, DR, backup, cloud regions)
41- Cross-border transfer mechanisms (SCCs, adequacy decisions, BCRs)
42- Retention post-termination; destruction methods; certificates of destruction
43- Backup frequency; encrypted backup media; tested RTO/RPO
44
45**3. Access Control & Privileged Access**
46- MFA enforcement across all access; supported factors
47- RBAC, least-privilege, segregation of duties
48- Privileged access: JIT elevation, session recording, auto-deprovisioning
49- Access recertification frequency; anomalous-access alerting
50
51**4. Vulnerability Management & Testing**
52- Scanning tools, frequency, and patching SLAs:
53
54| Severity | Patch SLA |
55|---|---|
56| Critical | ≤ 24–72 hrs |
57| High | ≤ 7 days |
58| Medium | ≤ 30 days |
59| Low | ≤ 90 days |
60
61- Annual third-party pentests (external + internal lateral movement)
62- AppSec testing (SAST, DAST, SCA) for custom software
63- Bug bounty / responsible disclosure program
64- Request most recent pentest summary and remediation status
65
66**5. Incident Response & Business Continuity**
67- Documented IR plan with roles, escalation, communication protocols
68- IR testing frequency (tabletop, simulations) and recent results
69- Notification timeline — must allow client to meet most restrictive regulatory deadline (GDPR 72 hrs, HIPAA 60 days, state breach laws)
70- Cooperation with client IR team and legal counsel
71- Cyber insurance: policy limits, third-party liability, adequacy for data volume
72- BCP/DR: tested RTO/RPO, geographic diversity, multi-scenario resilience
73
74**6. Encryption & Key Management**
75- At rest: minimum AES-256; scope includes production, dev/test, backups, portable media
76- Database encryption approach (TDE, column-level, application-layer)
77- In transit: TLS versions, deprecated protocol status, enforced cipher suites
78- In use: confidential computing / secure enclave capabilities (if applicable)
79- Key management: HSM/KMS storage, rotation frequency, secure destruction
80
81**7. Network Security & Segmentation**
82- Customer isolation; production vs. corporate separation
83- Zero-trust architecture status
84- Perimeter controls: firewalls, IDS/IPS, WAF, DDoS protection
85- Remote access: VPN, NAC/device posture, MFA
86- Assessment cadence (external scans, internal pentests, wireless)
87
88**8. Subprocessor Risk Management**
89- Complete subprocessor inventory: role, data access, location, assessments conducted
90- Flow-down of security requirements (contractually at least as stringent as client's)
91- Client notification and approval rights before new subprocessor engagement
92- Right to terminate non-compliant subprocessors
93
94**9. Certifications & Compliance**
95- SOC 2 Type II: report date, principles, opinion status, scope alignment
96- ISO 27001: certificate dates, scope, certification body
97- PCI DSS, FedRAMP/StateRAMP, HITRUST, TISAX (as applicable)
98- Regulatory compliance confirmation for applicable data types
99- Commitment to provide updated reports/certifications annually
100
101**10. Physical Security & Environmental Controls**
102- Data center access: MFA, visitor logs, surveillance, security personnel
103- Background checks for personnel with physical access
104- Environmental: fire suppression, UPS, generators, climate, water detection
105- Facility certifications (SSAE 18 SOC 1, Uptime Institute tier)
106
107**11. HR Security & Insider Threat**
108- Background checks; periodic re-investigation for sensitive roles
109- Security training before access; policy acknowledgment
110- Offboarding: access revocation timeline, exit procedures
111- Insider threat monitoring; DLP for exfiltration prevention
112
113## Risk Assessment Framework
114
115Score vendor responses after receipt:
116
117| Rating | Criteria |
118|---|---|
119| Low | Controls meet/exceed requirements; evidence provided |
120| Moderate | Minor gaps; addressable via contractual provisions |
121| High | Significant gaps; requires remediation plan with deadlines |
122| Critical | Fundamental deficiencies; disqualifying absent remediation |
123
124Assessment report must include:
125- Per-domain and overall risk rating with justification
126- Recommended contractual controls (audit rights, insurance minimums, SLAs)
127- Evidence gaps requiring follow-up
128- Go/no-go recommendation with conditions
129- Flagged inconsistencies between responses and publicly available information
130
131## Checks
132
133- State explicitly in preamble: responses are **contractually binding representations**; incomplete/misleading answers constitute grounds for disqualification or material breach
134- Align notification timelines with the **most restrictive applicable breach notification law**
135- Mark questions as required vs. conditional based on data type (PCI questions only if payment data involved)
136- Flag vendors refusing to disclose subprocessors or share certifications as elevated risk
137- All legal citations to specific regulatory provisions must be verified against current law [VERIFY]
CaseMark