Vendor Security Questionnaire

Everything needed to run a small-group roundtable before a supplier receives company information. The group walks the questionnaire: the program, the certificate, the data, access, incidents, subcontractors, and privacy. Includes a facilitator plan, agenda, discussion prompts, a four-stage tabletop, and a one-page handout.

90 min | 6–10 people | Buyers, Contract owners, Security leads, Technology leads

Join to save this for later.

• 24,768business email compromise complaints reported to the FBI in 2025
• $3.05Breported lost to business email compromise in 2025
• 18,774credit card and check fraud complaints in 2025
• $283Mreported lost to credit card and check fraud in 2025

As of 2025. Source: FBI Internet Crime Complaint Center (IC3) 2025 Annual Report

Outcomes

1. Send the questionnaire before the supplier receives company information.
2. Treat a yes with no certificate, date, or description as unfinished.
3. Name who accepts the questionnaire, and keep that copy with the supplier record.
4. Call a number you already have before a supplier payment account changes.

Agenda

Discussion topics

The security program and the certificate

A supplier can say they have a program. The useful answer names the owner and includes a certificate you can read, with an expiry.

• Who checks that a certificate is current before we accept the questionnaire?
• What do we do when the answer is yes and nothing is attached?

What data they hold, and where it sits

The questionnaire should say which information the supplier will see, and the place it is stored. The cloud is not a location.

• Can we name the data this supplier holds for us?
• Where would we look if we had to say which country it sits in?

Access, encryption, and vulnerabilities

Someone at the supplier can sign in. The questionnaire should say how that sign-in works, how the data is protected, and how they handle a known weakness.

• Do we ask whether their people use more than a password?
• Who reads the answer when they say encryption is only partial?

Incidents, continuity, and training

You need a person to call, a time they will tell you, and a way they keep going. Training is how their people learn to make that call.

• If this supplier is hit tonight, who do they call here, and how soon?
• How long can we operate if this supplier stops?

Subcontractors and privacy

The company that signed the contract may not be the only one who can see the data. Privacy is the promise about people whose information they hold.

• Which of our suppliers use another company to do the work?
• Where is that named on the questionnaire?

The Friday Questionnaire

Give each group one stage at a time, about 5 minutes apart. Groups answer each stage's question before seeing the next.

1. Friday, 4 p.m.

   A supplier returns the questionnaire with yes on every line. No certificate is attached. The contract is ready to sign on Monday, and the supplier will receive customer names.

   Do you accept the questionnaire?

2. Monday, 9 a.m.

   They send a certificate. The expiry date is last year. The place the data is stored is written as the cloud.

   What do you ask for before any data moves?

3. Monday, 11 a.m.

   On a call, they mention a second company that hosts the service and can see the data. That name is not on the questionnaire.

   Is the questionnaire finished?

4. The next Thursday

   An email from the supplier gives a new bank account for this month's invoice. The questionnaire said they would tell you about a security incident. This email does not say there was one.

   Do you pay, and who do you call?

Reveal debrief

• A yes with nothing attached is unfinished. Accepting it is a decision a named person makes, and the copy stays with the supplier record.
• Ask for a current certificate and a real location. The cloud is not enough to say where the data sits.
• A company that can see the data belongs on the questionnaire before access is turned on.
• A new bank account is confirmed with a number you already have. The number in the email is not that call.

Handout

Habits

• Send the questionnaire before the supplier receives company information.
• Ask for the certificate and the expiry, not only a yes.
• Write down the data they hold and where it is stored.
• Ask which other company, including a subcontractor, can see that data.
• Keep the accepted questionnaire with the supplier record.
• Call back before a supplier payment account changes, using a number you already trust.

Red flags

• Every answer is yes, and nothing is attached
• A certificate with no date, or a date that has passed
• A data location written only as the cloud
• A subcontractor who can see the data and is not named
• No person named to call if they have an incident
• A new bank account in an email from the supplier

First hour

1. Bank. Call the bank now and ask to stop or recall the payment.
2. Report. File at ic3.gov with the transaction details.
3. Notify. The person who owns the supplier, and the supplier on a number you already have.
4. Contain. Pause new access until the questionnaire is answered again, including any company that can see the data.

Facilitator checklist

ISO 27001:2022

• A.5.19 Information security in supplier relationships
• A.5.20 Addressing information security within supplier agreements
• A.5.21 Managing information security in the ICT supply chain
• A.5.22 Monitoring, review and change management of supplier services
• A.5.23 Information security for use of cloud services
• A.5.34 Privacy and protection of PII
• A.6.8 Information security event reporting
• A.8.5 Secure authentication

Want us to run this session for your team?

isms@itrygg.com