Free questionnaire · For Teams running third-party risk for themselves or clients
Vendor Security Questionnaire
A short, proportionate questionnaire gets answered; a 300-question one gets ignored. These questions cover what matters for most SaaS and IT suppliers, and leave room for evidence links.
Governance & assurance
Do you hold a current SOC 2 Type 2, ISO 27001 certificate or equivalent?
Request the report or certificate and scope.
Is there a named person responsible for information security?
Are security policies approved and reviewed at least annually?
Do staff complete security awareness training annually?
Are background checks performed on staff with access to customer data?
Do you carry cyber liability insurance?
Access control
Is MFA enforced for all staff access to systems holding our data?
Is access granted on least privilege and reviewed periodically?
Is access removed within 24 hours of termination?
Do you support SSO for customer accounts?
Are privileged accounts separately managed and logged?
Data protection
Where (which countries / regions) will our data be stored and processed?
Is our data encrypted at rest and in transit?
State algorithms / TLS versions.
Is customer data logically separated from other customers?
How is data returned and deleted at contract end?
Will you sign a data processing agreement?
List subprocessors that will access our data.
Is our data used to train AI or machine-learning models?
Security operations
Do you perform vulnerability scanning and patch critical issues within a defined SLA?
Is an independent penetration test performed at least annually?
Request an executive summary.
Are security logs centrally collected and monitored?
Is endpoint protection deployed on all staff devices?
Are code changes peer-reviewed before production?
Do you run a secure development lifecycle (e.g. dependency scanning)?
Incident response
Do you have a documented and tested incident response plan?
Within what timeframe will you notify us of a breach affecting our data?
Have you had a reportable security incident in the last 24 months?
Who is our security contact during an incident?
Resilience
What are your RTO and RPO for the service we use?
Are backups encrypted, stored separately and restore-tested?
Is the business continuity plan tested at least annually?
What uptime SLA do you commit to?
Do you depend on a single cloud region or provider?
AI & emerging risk
Does the service use generative AI or third-party AI models?
Which AI providers process our data, and under what terms?
Can AI features be disabled for our account?
Are AI outputs reviewed or monitored for accuracy and bias?
Do you follow an AI governance framework (e.g. ISO 42001, NIST AI RMF)?
How do you handle prompt-injection and data-leakage risks?
Is there a contact for AI-related concerns?
Get the full Vendor Security Questionnaire
All 40 items, plus a spreadsheet (CSV) you can open in Excel or Google Sheets. Free — we'll email you the link too.
No spam. Unsubscribe in one click. Prefer to skip? Start free — the full framework is built in.
Run this for every client — without the spreadsheet
NovaGRC tracks vendors per client with risk tiers, review dates and AI-assisted assessment — and the client portal collects vendor evidence without giving anyone a login.
The Starter plan is free: one client workspace, up to 3 team members, no credit card.
