Vendor security questionnaires: 15 questions worth asking

Ask fewer, more relevant questions

Vendor security questionnaires collect information about supplier controls. They work best when reviewers know which service, data and access the answers describe. A company-wide yes-or-no answer can obscure exceptions in the exact product you are buying. Start with a short baseline and add deeper questions for material exposure.

The following questions are an original starting set inspired by public supply-chain guidance. They are not a certification or a complete control framework. Ask the vendor to describe the practice, its scope and evidence, rather than simply checking yes.

Data and access

Map the data path before evaluating individual controls. Evidence might include an architecture summary, access policy extract or a service-specific assurance report. Avoid requesting secrets or production customer records.

• 1. What customer data is collected, where is it stored, and how long is it retained?
• 2. Who can access that data, and how is privileged access approved and reviewed?
• 3. Which authentication and account-provisioning options apply to this service?
• 4. How are customer environments separated?
• 5. How are encryption keys managed, and what encryption applies in transit and at rest?

Security operations and incident response

Ask for the workflow and evidence of operation, not a promise of perfect security. A supplier may be unable to share sensitive technical details; agree proportionate alternatives such as redacted summaries or restricted report access.

• 6. How are vulnerabilities prioritized, assigned and tracked to remediation?
• 7. What testing covers the purchased service, and how are findings followed up?
• 8. What security logs are retained and what monitoring supports investigations?
• 9. How will a customer be notified of a relevant incident, and who coordinates response?
• 10. How are material subcontractors assessed and changes communicated?

Resilience and exit

Continuity questions should connect to your own business needs. An assurance report does not automatically establish that your export procedure or integration can recover.

• 11. What recovery objectives apply, and what tests support them?
• 12. Which shared providers or dependencies could interrupt delivery?
• 13. How can customers export data in a usable format?
• 14. What happens to records and backups after termination?
• 15. What material changes will trigger customer notification or a fresh review?

How to handle incomplete answers

Separate not applicable, not implemented, unknown and evidence unavailable. Each means something different. Ask why a control does not apply to the scoped service, and document the explanation. Escalate material unknowns instead of assuming they are acceptable.

For each concern, record the answer, evidence reference, reviewer conclusion and follow-up owner. Compare the evidence with contracts and technical integration details. Reuse recent, relevant evidence where possible so the process does not become an unnecessary reporting burden, but do not reuse answers across services without checking applicability.