Vendor risk

What is a security questionnaire?

A security questionnaire is a set of questions a customer sends a vendor to assess how the vendor protects data, covering areas like access control, encryption, incident response, and compliance, as part of vendor due diligence.

Definition

A security questionnaire is a structured set of questions a prospective or current customer sends to a vendor to evaluate the vendor’s information security practices as part of third-party due diligence.

Background

When a company buys software that will touch its data, its security team vets the vendor, and a questionnaire is the common mechanism. Some are standardized (for example the Shared Assessments SIG, or the Cloud Security Alliance CAIQ), while many are the buyer’s own spreadsheet. Questions span access control, encryption, network security, incident response, business continuity, personnel security, and which compliance reports (such as SOC 2 or ISO 27001) the vendor holds.

Why it matters

For vendors, questionnaires are a recurring cost of doing business that can slow deals; consistent, accurate answers backed by evidence speed up security review. For buyers, they are a core vendor-risk tool. Either way, answers must be truthful, an inaccurate questionnaire response is a serious trust and liability problem.

Step by step

1. Maintain a reviewed library of standard answers grounded in your real controls and evidence.
2. Map incoming questions to your existing answers rather than rewriting each time.
3. Attach or reference evidence (like a SOC 2 report or trust center) where possible.
4. Have a knowledgeable owner review answers before they go out.
5. Keep the answer library current as your controls change.

Examples

• A buyer sends a 200-row spreadsheet covering encryption, access reviews, and incident response before signing.
• A vendor answers most questions by pointing to its trust center and SOC 2 report, and only writes bespoke answers for the rest.

Common mistakes

• Answering from memory instead of from documented, current controls and evidence.
• Overstating capabilities to win a deal, which creates real liability if a claim is untrue.
• Re-answering the same questions from scratch every time instead of reusing a maintained library.

FAQ