# Vendor risk assessment questionnaire > **Review with counsel before use.** This questionnaire is a starting point for reviewing a vendor that will handle your data. It is not legal advice, and a vendor's answers do not replace a contract. Have your attorney review the agreement, and the security terms in it, before you sign. > > Questionnaire from AccuSights, https://accusights.com/templates. A spreadsheet version is at https://accusights.com/downloads/vendor-risk-questionnaire.csv --- **Vendor:** ______________________________ **Service:** ______________________________ **Sent on:** ______________ **Returned on:** ______________ **Reviewed by:** ______________ Send the full list to vendors that will hold or reach sensitive data. For low-risk vendors, the first three sections are often enough. Ask for evidence (a report, a certificate, a policy) wherever a question allows it. ## Company and service 1. Legal name of the company providing the service, and its address. Answer: ____________________________________________________________ 2. Describe the service you provide to us. Answer: ____________________________________________________________ 3. Who is our security contact at your company (name, email, phone)? Answer: ____________________________________________________________ ## Data you will handle 4. Which of our data will you create, receive, store or transmit (for example customer records, PHI, CUI, payment card data, employee data)? Answer: ____________________________________________________________ 5. In which countries and cloud regions will our data be stored and processed? Answer: ____________________________________________________________ 6. Which of your staff will have access to our data, and why? Answer: ____________________________________________________________ ## Security program and reports 7. Do you have a current SOC 2 Type 2 report? Give the period it covers and the CPA firm that issued it. Answer: ____________________________________________________________ 8. Do you hold an ISO 27001 certificate? Give the certification body, the scope and the expiry date. Answer: ____________________________________________________________ 9. Do you have a written information security policy approved by leadership and reviewed yearly? Answer: ____________________________________________________________ 10. Who is responsible for security at your company? Answer: ____________________________________________________________ ## Access control 11. Is multi-factor authentication required for every account that can reach our data, including admin accounts? Answer: ____________________________________________________________ 12. Do you use single sign-on, and do you review access at least quarterly? Answer: ____________________________________________________________ 13. How quickly is access removed when one of your staff leaves? Answer: ____________________________________________________________ ## Encryption and data protection 14. Is our data encrypted at rest and in transit? Describe how. Answer: ____________________________________________________________ 15. Are company laptops and phones managed, encrypted and locked automatically? Answer: ____________________________________________________________ 16. How and when do you delete or return our data when the contract ends, including backups? Answer: ____________________________________________________________ ## Vulnerability management and testing 17. How often do you scan for vulnerabilities, and what are your fix timelines by severity? Answer: ____________________________________________________________ 18. When was your last penetration test, and who performed it? Were the findings fixed? Answer: ____________________________________________________________ ## Incidents and breach notification 19. Do you have an incident response plan, and when did you last test it? Answer: ____________________________________________________________ 20. How soon will you notify us of a security incident or breach involving our data? Answer: ____________________________________________________________ 21. Have you had a security breach in the last three years? If so, describe what happened and what changed. Answer: ____________________________________________________________ ## Subprocessors 22. List the subprocessors that will handle our data and what each does. Answer: ____________________________________________________________ 23. Do your contracts with subprocessors carry the same security obligations you accept with us? Answer: ____________________________________________________________ 24. Will you tell us before adding or changing a subprocessor? Answer: ____________________________________________________________ ## Business continuity 25. How often do you back up our data, and when did you last test a restore? Answer: ____________________________________________________________ 26. What are your recovery time and recovery point objectives for the service? Answer: ____________________________________________________________ ## AI use 27. Does the service use artificial intelligence on our data? Describe where and how. Answer: ____________________________________________________________ 28. Is our data used to train or improve any AI model, yours or a third party's? Can we opt out? Answer: ____________________________________________________________ ## Regulatory 29. If you will handle PHI for us, will you sign a HIPAA business associate agreement? Answer: ____________________________________________________________ 30. If you will handle CUI for us, how do you meet DFARS 252.204-7012 and NIST SP 800-171? Answer: ____________________________________________________________ 31. Which privacy and security laws do you consider your service subject to? Answer: ____________________________________________________________ ## Reviewer decision - [ ] Approved - [ ] Approved with conditions: ______________________________ - [ ] Not approved Next review date: ______________ Keep the completed questionnaire, the evidence and the decision with your vendor inventory. SOC 2 (CC9) and ISO 27001 (A.5.19 to A.5.22) both expect vendor reviews like this one to be repeated for critical vendors.