Vendor security questionnaire: 10 essential questions
Free sample from Runbook Foundry · CC BY 4.0 · For low- and medium-risk SaaS vendors
Send this before signing with a new vendor that will hold or access your data. Ask for evidence where noted. A recent independent audit report (for example a SOC 2 Type II report, or an ISO/IEC 27001 audit with its statement of applicability) can replace several answers. Check that the scope covers the service you're buying.
Vendor: __________ Service: __________ Data involved: __________ Completed by / date: __________
| # | Question | Vendor answer | Evidence |
|---|---|---|---|
| 1 | Data: What of our data will you store or process, where (countries/regions) is it stored, and who at your company can access it? | ||
| 2 | Sub-processors: Which third parties process our data? How will you tell us about changes? | Sub-processor list | |
| 3 | Authentication: Do you support SSO (SAML/OIDC) and MFA for our users? Is MFA required for your own staff with access to customer data? | ||
| 4 | Encryption: Is our data encrypted in transit and at rest? Who manages the keys? | ||
| 5 | Assurance: Do you have a current independent security audit or assessment? When does it expire? | Audit report | |
| 6 | Vulnerabilities: How often do you run penetration tests, and how quickly do you fix critical findings? | Summary letter | |
| 7 | Incidents: How quickly will you notify us of a security incident affecting our data, and through which contact? | Contract clause | |
| 8 | Backups and continuity: How often is our data backed up, how long would recovery take, and when did you last test a restore? | ||
| 9 | AI and data use: Do you use our data, prompts or outputs to train or improve AI models? Can we opt out? | Terms / DPA | |
| 10 | Exit: When the contract ends, how do we get our data back, in what format, and when is it deleted? |
How to read the answers
- Red flags: no MFA for vendor staff, "we don't share our sub-processors", no incident notice period, training on your data with no opt-out, no way to export data.
- Proportionality: for a vendor holding sensitive customer or employee data, go deeper (contract terms, a data processing agreement, an audit report review). For a low-risk tool with no personal data, these 10 questions are often enough.
- Record the decision: approved / approved with conditions / rejected, who decided, and when to review again (usually 12 months).
Templates and guidance only, not legal advice. Drafted with AI assistance and reviewed for accuracy. Not affiliated with Microsoft or Google.