Procurement Documents

Vendor Security Questionnaire Template (Free, Word)

A free, vendor-neutral security questionnaire for software and SaaS vendors, tiered by risk, with an evidence checklist, questions in eight sections, a findings log, contract terms and sign-off.

17 pages Microsoft Word Updated November 15, 2026
Download Template
Vendor Security Questionnaire Template (Free, Word)

Preview the first pages

See the structure before you download. The Word file has every section listed below, ready to fill in.

Open preview Give feedback

What's inside

The sections in the document, in order.

  1. Vendor and service details
  2. What each risk tier completes
  3. Evidence checklist
  4. Security questionnaire
  5. Reviewer findings (internal)
  6. Contract terms to carry forward (internal)
  7. Review sign-off (internal)

Use this vendor security questionnaire when a supplier will hold your data or connect to your systems, and you need to know whether it can protect them. It follows the vendor security assessment guide: tier the vendor by risk, ask for independent evidence first, use the questions for the gaps, then record what you found and what happens next. Some teams call it a vendor risk assessment questionnaire or a third-party risk assessment questionnaire.


It's written for whoever reviews vendor security, such as a security lead, an IT manager or a third-party risk team, working with procurement and the business owner who will use the service. Send it before the contract, while findings can still change the deal, and again at renewal or after a significant change at the vendor. If you're buying through an RFP, put a short list of security Must-haves in the RFP, such as those in the free RFP template, and send this questionnaire to your two or three finalists.


The Word file is a complete questionnaire you can use as it stands. Sections 1 to 4 go to the vendor: the service and its scope, which questions and evidence each risk tier provides, the evidence checklist and the questions themselves. Sections 5 to 7 stay with your review team: findings and red flags, the contract terms to carry forward, and sign-off.


What's inside this template


  • Vendor and service details, plus a scope table that records the data the vendor will hold, its access to your systems, and how critical and replaceable the service is
  • An example tier table that sets which questions and evidence a high, medium or low-risk vendor provides, so low-risk vendors answer four questions instead of the full set
  • An evidence checklist for a SOC 2 Type II report, an ISO/IEC 27001 certificate and statement of applicability, a penetration test summary, policies, a data processing agreement and a sub-processor list, with what to check in the report and the certificate
  • Questions in eight sections, from governance and policies to AI features and data use, each with the evidence to request and columns for the vendor's response and your reviewer's notes
  • A vendor confirmation that the answers are accurate, with a commitment to report significant changes
  • A findings table with a rating, an action (fix before signing, fix by a contract date, compensating control, accept the risk or reject), an owner and a due date, plus a red flags checklist
  • The contract terms to carry forward from the vendor's answers, and a sign-off with the next reassessment date and the triggers for an earlier one

Download the editable Microsoft Word version below. The full text is on this page, so you can read it before you download.

How to use this template

Fill in Section 1 and set the tier in Section 2 before you send anything. Send Sections 1 to 4 to the vendor, and keep Sections 5 to 7 for your review team.

  1. Set the scope and the tier. Record what data the vendor will store, process or see, what access it will get to your systems, and how critical and replaceable the service is. Pick the tier in Section 2, or use the one from the free vendor risk assessment template, then delete the questions and evidence that tier doesn’t need. Apply the same rules to every vendor, including SaaS bought on a credit card.
  2. Ask for the evidence first. Ask for the documents in Section 3 at the start, and tell the vendor it can point to a report instead of rewriting an answer. A current SOC 2 Type II report or ISO/IEC 27001 certificate that covers the service can answer several of the questions. Use of a SOC 2 report is restricted, so the vendor may ask for a nondisclosure agreement first.
  3. Send it with a contact and a return date. Name one person on your side for questions, and set a return date. If the vendor offers a completed standardized questionnaire published by an industry group, you can accept it for the questions it covers and ask only the rest.
  4. Read the answers against the evidence. Work through the report checks in Sections 3.2 and 3.3: scope, period, exceptions, subservice organizations and the controls left to you, or the certificate’s scope, validity, issuer and statement of applicability. Then read each answer against them. An answer that contradicts the report, or a “yes” with no evidence, needs a follow-up in writing.
  5. Record findings and carry them into the contract. Log each gap in Section 5, rate it by the harm it could do and decide the action. Write the vendor’s promises into the contract using Section 6, get sign-off in Section 7, and set the next reassessment date. The vendor risk management guide covers what happens after you sign.

How to write security questions that get real answers

A question a vendor can answer with “yes” usually gets a “yes”. Ask how a control works, when it was last tested and who is accountable for it, and say which answers need evidence.

Some rewrites, using questions from this template:

  • Weak: “Do you encrypt data?” Stronger: “How is our data encrypted in transit and at rest, and who manages the keys?”
  • Weak: “Do you have an incident response plan?” Stronger: “How soon after confirming an incident affecting our data will you tell us, and what will you include?” Then write the time into the contract.
  • Weak: “Are you compliant with [standard]?” Stronger: “Which independent reports or certifications cover the service we’re buying, and what scope and period does each cover?”
  • Weak: “Do you back up our data?” Stronger: “When did you last test restoring the service from backup, and what did the test show?”
  • Weak: “Is your AI safe?” Stronger: “Are our data, prompts or outputs used to train models that serve other customers, and can we opt out?”
  • Don’t ask what the evidence already answers. If the SOC 2 report covers how access is reviewed, point to it and ask only what it leaves out.
  • Put one question in each row, so each answer can be checked and each gap becomes one finding.
  • Keep it short for low-risk vendors. A long questionnaire sent to every vendor gets volume instead of evidence, and your team can’t review every answer properly.

The full template

This is the complete text of the Word document. Fill in the [bracketed] placeholders and delete the italic guidance before you use or send it.

1. Vendor and service details

Buyer instructions: replace every [bracketed placeholder], delete
anything that doesn’t apply, and delete all italic guidance before you
send this questionnaire. Fill in Section 1 and set the tier in Section 2
first. Sections 1 to 4 go to the vendor, and your reviewer completes the
checks in Sections 3.2 to 3.4 when the evidence arrives. Sections 5 to 7
are for your review team, so delete them from the vendor’s
copy.

Item Details
Buyer [Organization legal name]
Vendor [Vendor legal name]
Service assessed [Product or service, edition and modules]
Business owner [Name, title, email]
Security reviewer [Name, title, email]
Vendor security contact [Name, title, email]
Related RFP or contract [RFP or contract number, or new purchase]
Reason for this assessment [New vendor / Renewal / Significant change at the vendor /
Incident]
Risk tier (Section 2) [High / Medium / Low]
Sent on / Return by [Date] / [Date]

1.1 Scope

Complete this before you send the questionnaire, and ask the
vendor to correct anything that’s wrong. The answers set the tier in
Section 2.

Scope question Answer
Data the vendor will store, process or see [For example: customer records, employee data, financial data,
internal documents]
Personal or regulated data [None / Personal data: categories / Regulated data: type]
Access to our systems [None / User accounts / Administrator rights / API or integration
access / Software installed on our devices or servers]
Systems it will connect to [Identity provider, ERP, CRM, others]
How critical the service is [What stops, and for whom, if it’s unavailable]
How hard it would be to replace [Easy / Needs a planned migration / Very hard]
AI features we expect to use [None / Names of features]
Out of scope [Other products or services from this vendor]

1.2 Instructions for the
vendor

In this questionnaire, “we” and “our” mean [Organization name], and
“you” means [Vendor name].

  • Answer every question in Section 4 for the service in Section 1, and
    say how each control works. “Yes” on its own isn’t an answer.
  • Where we ask for evidence, attach it or name the document, page and
    section. If a document under Section 3 already answers a question, point
    to it.
  • If a control isn’t in place, say so, and give a date if one is
    planned.
  • [You may attach a completed standardized security questionnaire
    published by an industry group and answer here only what it doesn’t
    cover.]
  • Send questions to [name and email], and return this questionnaire by
    [date]. We will treat your answers and documents as confidential [under
    the nondisclosure agreement dated [date]].

2. What each risk tier
completes

The tiers below are an example to adjust to your policy. Choose
the highest tier any answer in Section 1.1 points to, or use the tier
from your vendor risk assessment, and re-tier if the vendor’s data or
access changes. Apply the same rules to every vendor, including SaaS
bought on a credit card. Before sending, delete what the tier doesn’t
need.

Example tier What puts a vendor here Questions to answer (Section 4) Evidence to provide (Section 3)
High Sensitive or regulated data, privileged access, or a service we
can’t run without, such as payroll or our identity provider		 All questions E-1 or E-2, plus E-3, E-5 and E-6
Medium Internal business data, or a connection to some of our systems The first three questions in each part of Section 4 E-1 or E-2, plus E-5 if the vendor will process personal data
Low No sensitive data, no access to our systems, and easy to
replace		 IA-1, DP-1, DP-3 and LI-2 only None required

If you know the product has no AI features, keep only AI-1 and
AI-2 from Section 4.8, so the vendor’s answer is on record.

3. Evidence checklist

Ask for independent evidence first, use Section 4 for the gaps,
and read what you get. A SOC 3 report is a general-use version without
the system description or the auditor’s tests and results, so it can’t
stand in for E-1.

3.1 Documents requested

ID Evidence Required for Provided What the reviewer checks
E-1 SOC 2 Type II report covering the service High and Medium: E-1 or E-2 Section 3.2
E-2 ISO/IEC 27001 certificate and statement of applicability High and Medium: E-1 or E-2 Section 3.3
E-3 Penetration test summary or letter from an independent tester High The date, what was tested, and whether serious findings were fixed
and retested
E-4 Policies for security, incident response, business continuity and
secure development		 Where a question asks for one An owner and a recent review date on each
E-5 Data processing agreement High; Medium if personal data is involved Reviewed by [privacy or legal]
E-6 Sub-processor list High Each company that processes our data for the vendor, what it does
and where

Use of a SOC 2 report is restricted, so the vendor may ask for a
nondisclosure agreement first. If the vendor has neither E-1 nor E-2 and
no plan to get one, record a finding, and decide in advance what other
evidence, if any, you will accept.

3.2 SOC 2 Type II report
review

A Type I report covers the design of controls at a point in time.
A Type II report also covers whether they operated effectively
throughout a period, with the auditor’s tests and results, so ask for
Type II.

Check What to look for Result and notes
Report type and issuer A Type II report from an independent CPA firm, under AICPA
standards		 [Type; CPA firm]
Scope The system description covers the service in Section 1. Note which
trust services categories are included: security, availability,
processing integrity, confidentiality, privacy.		 [Covered / Partly / Not covered; categories]
Period When it ended. If long ago, ask when the next report is due. [Dates; next report due]
Exceptions Read the test results, not only the opinion, for controls that
didn’t work as described. Ask what the vendor did about each.		 [Exceptions, responses, finding numbers]
Subservice organizations Whether the report includes each one’s controls (the inclusive
method) or excludes them (the carve-out method). For a carved-out
provider, get evidence about it too.		 [Name, method, evidence received]
Complementary user entity controls Controls the vendor’s design assumes we will run [Listed in Section 3.4]

3.3 ISO/IEC 27001
certificate review

ISO/IEC 27001 sets requirements for an information security
management system (ISMS). ISO doesn’t certify organizations: an
independent certification body audits the ISMS and issues a certificate
with a defined scope.

Check What to look for Result and notes
Scope Includes the service in Section 1 and the teams and locations that
run it		 [Covered / Partly / Not covered]
Validity The certificate’s dates. Confirm with the certification body that
it’s current.		 [Dates; how confirmed]
Issuer The certification body, and whether a national accreditation body
has accredited it		 [Certification body; accreditation body]
Statement of applicability The controls the organization decided it needs, why, whether each is
implemented, and why it excluded any reference controls in Annex A.
Excluded or unimplemented controls are ones we can’t count on.		 [Controls that matter here and are excluded or not implemented;
finding numbers]

3.4 Controls left to us

Give each complementary user entity control from the SOC 2 report
an owner on your side.

Complementary user entity control Our owner How we will carry it out
[Example: removing users’ access when our staff leave] [IT service desk] [Deprovisioning through our identity provider]
[Control] [Owner] [How]

4. Security questionnaire

In the Evidence requested column, an E number means attach that
document from Section 3 or point to the page and section that answers
the question. Leave the Reviewer notes column blank.

4.1 Governance and policies

ID Question Evidence requested Vendor response Reviewer notes
GP-1 Who is accountable for information security, and who do they report
to?		 Name or role
GP-2 When were your security policies last reviewed and approved, and by
whom?		 E-4
GP-3 Do staff with access to customer data get security training and,
where the law allows, background checks?		 Written answer
GP-4 Which independent reports or certifications cover the service in
Section 1, and what scope and period does each cover?		 E-1 or E-2
GP-5 How do you assess and treat risks to your own information security,
and when did you last do it?		 Written answer
GP-6 Have you had a security incident affecting customer data in
[period]? If so, what happened and what did you change?		 Written answer

4.2 Identity and access

ID Question Evidence requested Vendor response Reviewer notes
IA-1 Can we enforce single sign-on through our identity provider (SAML or
OIDC) and provision users through SCIM? If single sign-on isn’t
available, can we require multi-factor authentication for every user? Is
either limited to a higher edition or an extra fee?		 Product documentation
IA-2 Do all your staff who can reach production systems use multi-factor
authentication?		 E-1 or E-2
IA-3 How is privileged access to production systems and customer data
granted, reviewed and removed?		 E-4 or E-1
IA-4 When someone leaves your company or changes role, how quickly is
their access removed?		 E-1 or E-2
IA-5 Can your support staff see our data? If so, how is that access
approved, limited and logged?		 Written answer
IA-6 How are the API keys, tokens and service accounts that connect to
our systems scoped, rotated and revoked?		 Product documentation

4.3 Data protection and
encryption

ID Question Evidence requested Vendor response Reviewer notes
DP-1 Where are our data and backups stored, and can we choose the region?
Name the countries.		 Hosting description; E-6
DP-2 How is our data encrypted in transit and at rest, and who manages
the keys? Can we manage our own keys?		 Written answer or E-1
DP-3 How do we export our data, and in what format? How will you confirm
its deletion at exit, including from backups?		 Product documentation; proposed contract wording
DP-4 How is our data kept separate from other customers’ data? Architecture description
DP-5 What data do you collect about our use of the service, such as usage
data and logs, and what do you use it for?		 E-5; privacy notice
DP-6 Is our data ever copied into test or development environments? If
so, how is it protected or masked?		 Written answer

4.4
Application security and vulnerability management

ID Question Evidence requested Vendor response Reviewer notes
AS-1 How do you check your code and open-source components for
vulnerabilities before release?		 E-4 (secure development)
AS-2 What are your target times to fix vulnerabilities, by severity, and
how do you track whether you meet them?		 Vulnerability management procedure
AS-3 Do you publish a vulnerability disclosure policy? Where? Link to the policy
AS-4 When did an independent tester last test the service, what was in
scope, and were serious findings fixed and retested?		 E-3
AS-5 How are changes to production reviewed, approved and tested before
release?		 E-1 or E-2
AS-6 How do you protect your source code, build systems and software
updates from tampering? For any software we install, such as an agent,
can you provide a software bill of materials (SBOM)?		 Written answer; SBOM if available

4.5 Logging and incident
response

ID Question Evidence requested Vendor response Reviewer notes
LI-1 Which security events do you log, for how long, and can we get the
logs for our account?		 Product documentation
LI-2 How soon after confirming an incident affecting our data will you
tell us, and what will you include? Will you put that time in the
contract?		 E-4 (incident response); proposed contract wording
LI-3 When did you last test your incident response plan, and how? Date and type of test
LI-4 Can we send the audit log of user and administrator actions to our
own security monitoring tools?		 Product documentation
LI-5 How do you monitor the service for attacks and suspicious activity,
and who responds outside business hours?		 Written answer
LI-6 How do we report a suspected incident to you, and who will be our
contact during one?		 Contact details

4.6 Business continuity

ID Question Evidence requested Vendor response Reviewer notes
BC-1 When did you last test restoring the service from backup, and what
did the test show?		 Date and summary of the test
BC-2 What are your recovery time and recovery point objectives, and will
you put them in the contract?		 E-4 (business continuity)
BC-3 What happens if your hosting provider’s region fails? Architecture description
BC-4 How often are backups taken, where are they kept, and how are they
protected from deletion or tampering?		 Written answer
BC-5 What availability do you commit to, how is it measured, and where do
you publish service status?		 Service-level agreement
BC-6 When did you last test your business continuity plan, and did the
test include losing a key supplier?		 Date and type of test

4.7
Sub-processors and the vendor’s own suppliers

ID Question Evidence requested Vendor response Reviewer notes
SP-1 Which sub-processors handle our data, for what, and in which
countries?		 E-6
SP-2 How do you assess your own critical suppliers’ security? Supplier security procedure
SP-3 How much notice will you give before adding a sub-processor, and can
we object or leave?		 E-5; proposed contract wording
SP-4 Which hosting provider runs the service? Does your SOC 2 report
include it or carve it out?		 E-1
SP-5 Do you pass your security and data protection terms down to
sub-processors, and what evidence do you get from them?		 Written answer
SP-6 Do contractors or outsourced teams have access to our data or
production systems? Where are they based?		 Written answer

4.8 AI features and
data use, where relevant

ID Question Evidence requested Vendor response Reviewer notes
AI-1 Which features use AI, and can our administrators switch them
off?		 Product documentation
AI-2 Are our data, prompts or outputs used to train models that serve
other customers, and can we opt out?		 Contract or terms wording
AI-3 Which outside model providers process our data, and how long are
prompts and outputs kept?		 E-6
AI-4 Are new AI features switched on by default, and how will you tell us
before adding one that uses our data?		 Written answer
AI-5 Can an AI feature show a user data that the user couldn’t open
directly?		 Product documentation
AI-6 Can an AI feature take actions, such as sending messages or changing
records? If so, what approvals and logs apply?		 Product documentation

4.9 Vendor confirmation

[Vendor legal name] confirms that its answers in Section 4 and its
documents under Section 3 are accurate and complete as of the date
below, and will tell [Organization name] in writing of any significant
change that affects them, such as a new hosting provider or
sub-processor, a change of ownership, or a new AI feature that uses
customer data.

Name Title Signature Date
[Name] [Title]

5. Reviewer findings
(internal)

Internal: delete Sections 5 to 7 from the vendor’s copy. Check
each answer against the evidence, record each gap as a finding, rate it
by the harm it could do, and decide the action.

5.1 Findings

No. Finding Source Rating Action Owner Due date
1 [Example: incident notification promised “promptly”, with no defined
time]		 LI-2 [High] [Fix before signing: a defined time in the contract] [Procurement lead] [Date]
2 [Example: hosting provider carved out of the SOC 2 report, with no
other evidence]		 E-1, SP-4 [Medium] [Fix before signing: evidence about the hosting provider] [Security reviewer] [Date]
3 [Finding] [Question or evidence ID] [High / Medium / Low] [Action] [Owner] [Date]

Example ratings, to adjust to your policy. High: could expose
sensitive data, give someone unauthorized access to our systems, or stop
a service we can’t run without. Medium: weakens a control, but other
controls limit the harm. Low: a minor gap, or missing documentation for
a control that otherwise appears to work.

Actions:

  • Fix before signing: for gaps that matter at the
    vendor’s tier.
  • Fix by a contract date: the fix and its date go
    into the contract (Section 6).
  • Compensating control: a control on our side that
    offsets the gap, such as keeping one type of data out of the
    service.
  • Accept the risk: signed by the business owner in
    Section 7, with a review date.
  • Reject: the gap can’t be fixed or offset.

5.2 Red flags

Ask the vendor about each one that applies, and record the
answer.

Red flag Present? Vendor’s explanation and finding number
No independent report or certificate, and no plan to get one [Yes / No]
A report or certificate whose scope leaves out the service we’re
buying		 [Yes / No]
Unexplained SOC 2 exceptions, or an old report period with no newer
report due		 [Yes / No]
Refusal to name sub-processors [Yes / No]
Vague incident notification, such as “promptly”, with no defined
time		 [Yes / No]
Answers that contradict the report, or “yes” to everything with no
evidence		 [Yes / No]
No clear answer on whether our data trains models for other
customers		 [Yes / No]

6. Contract terms to
carry forward (internal)

If you’re running an RFP, put these terms in it so bidders price
and accept them before award. Have counsel review the wording.

Term Source What the contract should say Clause
Incident notification LI-2 Notice within [time] of the vendor confirming an incident affecting
our data, what it contains, and how the vendor will cooperate		 [Clause]
Sub-processor changes SP-3 [Period] of notice before a new sub-processor handles our data, and
a right to object or leave		 [Clause]
Independent reports GP-4 A current report or certificate covering the service for the whole
term, and copies of new ones as they’re issued		 [Clause]
Data location DP-1 Our data and backups stay in [countries or regions] [Clause]
Data return and deletion DP-3 Our data returned in [format] within [period] after the contract
ends, then deleted, including backups, with written confirmation		 [Clause]
Recovery and availability BC-2, BC-5 The recovery objectives stated in BC-2; availability, how it’s
measured and the credits for a miss		 [Clause]
AI and data use AI-2 Our data, prompts and outputs aren’t used to train models that serve
other customers		 [Clause]
Audit rights GP-4 Our right to receive audit reports, ask follow-up questions and,
where it matters, assess the vendor		 [Clause]
Dated fixes Section 5 Each “Fix by a contract date” finding, and its date [Clause]

7. Review sign-off (internal)

Item Details
Tier confirmed [High / Medium / Low]
Evidence reviewed [E numbers, with report periods or certificate dates]
Recommendation [Approve / Approve with conditions / Reject]
Conditions [Finding numbers, with what must be done and by when]
Risks accepted [Finding numbers and review date]
Next reassessment [Date, from the interval our policy sets for this tier]
Reassess earlier if Renewal, a significant change at the vendor, or an incident at the
vendor or one of its suppliers
Name Role Decision or comment Signature Date
[Name] Security reviewer
[Name] Business owner, accepting any risks marked “Accept the risk”
[Name] Procurement
[Name] [Privacy or legal, if personal data is involved]

Keep this questionnaire, the evidence and this sign-off with the
vendor’s record.

Frequently asked questions

What is a vendor security questionnaire?

It’s a set of questions a buyer sends a supplier to find out how it protects the buyer’s data and access to the buyer’s systems. It covers what independent evidence, such as a SOC 2 report or ISO/IEC 27001 certificate, doesn’t, and asks for proof behind the answers that matter. Some teams call it a vendor risk assessment questionnaire or a third-party risk assessment questionnaire.

What questions should a vendor security questionnaire include?

Questions on governance and policies, identity and access, data protection and encryption, application security and vulnerability management, logging and incident response, business continuity, and the vendor’s sub-processors and own suppliers. Add AI features and data use where the product has them. This template has six questions in each of those eight sections, each with the evidence to request.

Is a SOC 2 report enough, or do I still need a questionnaire?

A SOC 2 Type II report is strong evidence, but not enough on its own. Check that its scope covers the service you’re buying, that the period is recent, and what the exceptions and the controls left to you mean. Then use the questionnaire for what the report may not answer, such as where your data is stored, the incident notification time the vendor will commit to, and how AI features use your data.

How long should a vendor security questionnaire be?

Match the length to the vendor’s risk. In this template’s example tiers, a low-risk vendor answers four questions, a medium-risk vendor answers the first three in each section and provides an independent report or certificate, and a high-risk vendor answers every question and provides the full evidence set. Sending the full set to every vendor gets volume instead of evidence and leaves your team too little time to review it.

How should a vendor answer a security questionnaire?

Answer each question directly, say how the control works, and point to the page or section of the SOC 2 report or other evidence that supports it. Where a control isn’t in place, say so and give a date if one is planned. This template lists answers that contradict the evidence, or a yes to everything with no evidence, as red flags for the reviewer.

Related guides and templates

Download Template

Guides for this purchase

RequirementsRequirements Gathering for Software Purchases: Template and Traceability MatrixCollect and write requirements before the RFP goes out.GuideHow to Write an RFP: A Section-by-Section GuideWhat goes in each section of an RFP.ScoringRFP Scoring Matrix and Evaluation Criteria: How to Score ProposalsBuild a scoring matrix and score every proposal the same way.

More procurement documents templates