---

name: vendor-security-assessment language: en description: Drafts a Vendor Security Assessment Questionnaire evaluating third-party cybersecurity posture, data handling, and regulatory compliance. Vendor responses become binding contractual representations with executive certification. Use during vendor due diligence, third-party risk management, procurement security review, or subprocessor evaluation.

Vendor Security Assessment Questionnaire

Generates a pre-contract due-diligence questionnaire for evaluating vendor security controls, data practices, and compliance across GDPR, CCPA, HIPAA, SOX, GLBA, FERPA, and industry frameworks.

Quick Start

Gather before drafting:

1. Vendor scope — data types accessed (PII, PHI, PCI, financial, proprietary), processing activities, data flows
2. Applicable regulations — GDPR, CCPA, HIPAA, SOX, GLBA, FERPA, or sector-specific
3. Risk tolerance — what constitutes acceptable vs. disqualifying vendor risk
4. Contract alignment — security provisions to incorporate by reference

Document Framework

Element	Requirement
Preamble	Completion mandatory pre-contract; responses are binding representations
Executive certification	Senior officer (CISO/CTO/CLO) attests accuracy; signature block required
Submission deadline	10–15 business days
Change notification	Vendor notifies within 5 business days of material security changes
Confidentiality	Questionnaire and responses treated as confidential business information

Assessment Domains

Draft numbered questions per domain. Each question includes a response field and evidence-request field where applicable. Tailor scope to data sensitivity — not every vendor needs every domain.

1. Information Security Governance

• Dedicated CISO/equivalent; certifications (CISSP, CISM, CISA)
• Framework alignment (NIST CSF, ISO 27001, CIS Controls, COBIT)
• Policy review cadence; security awareness training (all-staff + specialized)
• Board-level security reporting frequency

2. Data Classification & Lifecycle

• Classification taxonomy compatibility with client's scheme
• All data storage/processing locations (primary, DR, backup, cloud regions)
• Cross-border transfer mechanisms (SCCs, adequacy decisions, BCRs)
• Retention post-termination; destruction methods; certificates of destruction
• Backup frequency; encrypted backup media; tested RTO/RPO

3. Access Control & Privileged Access

• MFA enforcement across all access; supported factors
• RBAC, least-privilege, segregation of duties
• Privileged access: JIT elevation, session recording, auto-deprovisioning
• Access recertification frequency; anomalous-access alerting

4. Vulnerability Management & Testing

• Scanning tools, frequency, and patching SLAs:

Severity	Patch SLA
Critical	≤ 24–72 hrs
High	≤ 7 days
Medium	≤ 30 days
Low	≤ 90 days

• Annual third-party pentests (external + internal lateral movement)
• AppSec testing (SAST, DAST, SCA) for custom software
• Bug bounty / responsible disclosure program
• Request most recent pentest summary and remediation status

5. Incident Response & Business Continuity

• Documented IR plan with roles, escalation, communication protocols
• IR testing frequency (tabletop, simulations) and recent results
• Notification timeline — must allow client to meet most restrictive regulatory deadline (GDPR 72 hrs, HIPAA 60 days, state breach laws)
• Cooperation with client IR team and legal counsel
• Cyber insurance: policy limits, third-party liability, adequacy for data volume
• BCP/DR: tested RTO/RPO, geographic diversity, multi-scenario resilience

6. Encryption & Key Management

• At rest: minimum AES-256; scope includes production, dev/test, backups, portable media
• Database encryption approach (TDE, column-level, application-layer)
• In transit: TLS versions, deprecated protocol status, enforced cipher suites
• In use: confidential computing / secure enclave capabilities (if applicable)
• Key management: HSM/KMS storage, rotation frequency, secure destruction

7. Network Security & Segmentation

• Customer isolation; production vs. corporate separation
• Zero-trust architecture status
• Perimeter controls: firewalls, IDS/IPS, WAF, DDoS protection
• Remote access: VPN, NAC/device posture, MFA
• Assessment cadence (external scans, internal pentests, wireless)

8. Subprocessor Risk Management

• Complete subprocessor inventory: role, data access, location, assessments conducted
• Flow-down of security requirements (contractually at least as stringent as client's)
• Client notification and approval rights before new subprocessor engagement
• Right to terminate non-compliant subprocessors

9. Certifications & Compliance

• SOC 2 Type II: report date, principles, opinion status, scope alignment
• ISO 27001: certificate dates, scope, certification body
• PCI DSS, FedRAMP/StateRAMP, HITRUST, TISAX (as applicable)
• Regulatory compliance confirmation for applicable data types
• Commitment to provide updated reports/certifications annually

10. Physical Security & Environmental Controls

• Data center access: MFA, visitor logs, surveillance, security personnel
• Background checks for personnel with physical access
• Environmental: fire suppression, UPS, generators, climate, water detection
• Facility certifications (SSAE 18 SOC 1, Uptime Institute tier)

11. HR Security & Insider Threat

• Background checks; periodic re-investigation for sensitive roles
• Security training before access; policy acknowledgment
• Offboarding: access revocation timeline, exit procedures
• Insider threat monitoring; DLP for exfiltration prevention

Risk Assessment Framework

Score vendor responses after receipt:

Rating	Criteria
Low	Controls meet/exceed requirements; evidence provided
Moderate	Minor gaps; addressable via contractual provisions
High	Significant gaps; requires remediation plan with deadlines
Critical	Fundamental deficiencies; disqualifying absent remediation

Assessment report must include:

• Per-domain and overall risk rating with justification
• Recommended contractual controls (audit rights, insurance minimums, SLAs)
• Evidence gaps requiring follow-up
• Go/no-go recommendation with conditions
• Flagged inconsistencies between responses and publicly available information

Checks

• State explicitly in preamble: responses are contractually binding representations; incomplete/misleading answers constitute grounds for disqualification or material breach
• Align notification timelines with the most restrictive applicable breach notification law
• Mark questions as required vs. conditional based on data type (PCI questions only if payment data involved)
• Flag vendors refusing to disclose subprocessors or share certifications as elevated risk
• All legal citations to specific regulatory provisions must be verified against current law [VERIFY]