06 Vendor Questionnaires

Vendor questionnaires are one of the most common tools used in:

Third-Party Risk Management

Vendor Risk Management

Supplier Security

Privacy Due Diligence

Cloud Security Assessments

Compliance Reviews

They help organizations understand:

What controls does the vendor claim to have, and what evidence supports those claims?

But a questionnaire should never become:

Send Questions
      ↓
Receive "Yes"
      ↓
Approve Vendor

A mature process looks like:

Vendor Risk Tier
      ↓
Questionnaire Scope
      ↓
Control Questions
      ↓
Vendor Response
      ↓
Evidence Request
      ↓
Response Validation
      ↓
Risk Scoring
      ↓
Findings
      ↓
Clarification
      ↓
Remediation
      ↓
Residual Risk
      ↓
Approval Decision

Learning Objectives

By the end of this lesson, you will be able to:

Explain the purpose of vendor questionnaires.
Understand where questionnaires fit into TPRM.
Build risk-tiered questionnaires.
Design meaningful security questions.
Avoid ineffective yes/no questionnaires.
Request supporting evidence.
Assess cybersecurity controls.
Assess privacy controls.
Assess compliance controls.
Assess resilience controls.
Assess cloud vendors.
Assess SaaS providers.
Assess AI vendors.
Identify questionnaire red flags.
Validate inconsistent responses.
Score questionnaire results.
Handle unanswered questions.
Manage vendor clarifications.
Document findings.
Track vendor remediation.
Build an auditable questionnaire evidence pack.
Develop questionnaire KPIs and KRIs.

1. What Is a Vendor Questionnaire?

A Vendor Questionnaire is a structured set of questions used to evaluate a third party’s:

Governance

Cybersecurity

Privacy

Compliance

Resilience

Operational Controls

The questionnaire helps the organization understand:

What Controls Exist?

How Are They Implemented?

How Are They Tested?

What Evidence Exists?

What Risks Remain?

2. Where Questionnaires Fit

Vendor questionnaires usually appear after:

Vendor Intake
      ↓
Inherent Risk Assessment
      ↓
Risk Tiering

and before:

Final Risk Decision

Full lifecycle:

Vendor Request
      ↓
Inherent Risk
      ↓
Risk Tier
      ↓
Questionnaire
      ↓
Evidence Review
      ↓
Findings
      ↓
Residual Risk
      ↓
Approval

3. Questionnaire Is Not Due Diligence by Itself

A questionnaire is:

One Source
of Vendor Information

Due diligence may additionally include:

SOC Reports

ISO Certificates

Penetration Testing

Architecture

Policies

BCP Evidence

Contract Review

Security Ratings

Therefore:

Questionnaire
≠
Complete Vendor Assurance

4. Why Questionnaires Are Useful

They help organizations create:

Consistent Questions

Repeatable Assessments

Comparable Vendor Responses

Documented Evidence

Risk-Based Decisions

5. Why Questionnaires Fail

Poor questionnaires often contain:

Hundreds of Questions

Duplicate Questions

Unclear Wording

Only Yes / No Answers

No Evidence Requirement

No Risk Context

The result:

Vendor Fatigue
+
Low-Quality Answers
+
Weak Assurance

6. Risk-Based Questionnaire Design

Do not send every supplier the same questionnaire.

Start with:

Vendor Risk Tier

Example:

Tier	Questionnaire
Tier 1 — Critical	Comprehensive
Tier 2 — High	Detailed
Tier 3 — Medium	Standard
Tier 4 — Low	Basic

7. Basic Vendor Questionnaire

Low-risk vendors may need only questions covering:

Service

Data Access

System Access

Security Contact

Incident Process

Basic Security Controls

8. Standard Vendor Questionnaire

Medium-risk vendors may require:

Governance

IAM

Encryption

Vulnerability Management

Incident Response

Privacy

BCP

9. Critical Vendor Questionnaire

Critical vendors may require deeper assessment of:

Security Governance

Privileged Access

Secure SDLC

Cloud Security

Threat Detection

Penetration Testing

Privacy

Subprocessors

Business Continuity

Disaster Recovery

Supply Chain

AI

Compliance

10. Build the Questionnaire Structure

Create:

01 Vendor Security Questionnaire

Recommended sections:

01 Organization

02 Security Governance

03 Asset Management

04 Identity & Access

05 Data Protection

06 Encryption

07 Network Security

08 Vulnerability Management

09 Secure Development

10 Logging & Monitoring

11 Incident Response

12 Business Continuity

13 Privacy

14 Compliance

15 Subprocessors

16 Cloud Security

17 AI Governance

18 Personnel Security

11. Question Design Principle

A good question should identify:

Control

Scope

Frequency

Responsibility

Evidence

12. Weak Question

Do You Use MFA?

Vendor:

Yes

But where?

Administrators?

Employees?

Cloud?

VPN?

Customer Portal?

The answer provides little assurance.

13. Better Question

Ask:

Is MFA enforced for privileged administrative access, remote access, and production-system access? Describe the authentication controls and provide supporting evidence.

This asks for:

Scope

Control

Implementation

Evidence

14. Avoid Ambiguous Language

Weak:

Do You Have
Strong Encryption?

Better:

Describe Encryption
for Data at Rest
and Data in Transit,
Including Standards
and Key Management.

15. Use Conditional Questions

Example:

Do You Process
Personal Data?

If:

No

privacy-detail questions may not apply.

If:

Yes

open:

Privacy

Retention

Deletion

Subprocessors

Rights

Data Location

sections.

16. Build Questionnaire Logic

Conceptually:

Question
      ↓
Response
      ↓
Risk Trigger?
      │
      ├── No → Continue
      │
      └── Yes
             ↓
Additional Questions

17. Organization Questions

Ask:

Legal Entity?

Headquarters?

Service Locations?

Number of Employees?

Security Contact?

Privacy Contact?

Critical Subcontractors?

18. Service Scope

Understand:

What Service
Is Being Provided?

Where Is It Hosted?

Who Operates It?

What Data
Does It Receive?

19. Security Governance Questions

Ask:

Is There a Formal
Information Security Program?

Who Owns Security?

Are Policies Approved?

How Often
Are They Reviewed?

Is Risk Assessment
Performed?

20. Security Leadership

Evidence may include:

Security Organization Chart

Policy

Governance Charter

Management Review

21. Risk Management

Ask:

How Frequently
Do You Perform
Cybersecurity Risk
Assessments?

and:

How Are Identified
Risks Tracked
and Remediated?

22. Asset Management

Ask:

Do You Maintain
an Inventory of:

Hardware?

Software?

Cloud Assets?

Production Systems?

23. Data Inventory

For data-processing vendors:

Do You Maintain
an Inventory of
Customer Data
Locations?

24. IAM Questions

Ask about:

Provisioning

MFA

SSO

RBAC

PAM

Service Accounts

Access Reviews

Offboarding

25. User Provisioning

Ask:

Describe the approval process used before granting employees or contractors access to production systems.

26. MFA

Ask separately for:

Administrative Access

Remote Access

VPN

Cloud Console

Production

Critical SaaS

27. Privileged Access

Ask:

Are Privileged
Accounts Separate
from Standard Accounts?

Is PAM Used?

Are Sessions Logged?

Is MFA Required?

28. Access Reviews

Ask:

How Often
Are Access Reviews
Performed?

and:

Which Systems
Are Included?

29. Offboarding

Ask:

How Quickly
Is Access Removed
When Personnel Leave?

30. Service Account Questions

Ask:

Are Service Accounts
Inventoried?

Owned?

Least Privileged?

Credential-Rotated?

Reviewed?

31. Data Protection Questions

Ask:

What Customer Data
Is Processed?

Where Is It Stored?

Who Can Access It?

How Is It Classified?

How Long
Is It Retained?

32. Encryption Questions

Assess:

Encryption at Rest

Encryption in Transit

Backups

Keys

Certificates

33. Encryption Algorithms

Avoid asking only:

Is Data Encrypted?

Ask:

Describe the encryption mechanisms used for customer data at rest and in transit.

34. Key Management

Ask:

Where Are Keys Stored?

Who Can Access Them?

How Are Keys Rotated?

How Are Keys Revoked?

35. Network Security Questions

Assess:

Firewall

Segmentation

Remote Access

IDS / IPS

Zero Trust

Wireless

Administrative Networks

36. Internet-Facing Systems

Ask:

How Are
Internet-Facing Assets
Inventoried and
Continuously Monitored?

37. Vulnerability Management Questions

Ask about:

Scanning

Severity

Patch SLA

Exceptions

Validation

External Testing

38. Vulnerability Scan Frequency

Ask:

How frequently are production systems scanned for vulnerabilities?

39. Remediation SLAs

Ask vendor to provide:

Critical SLA

High SLA

Medium SLA

Low SLA

40. Actively Exploited Vulnerabilities

Ask:

Do You Have
an Accelerated Process
for Actively Exploited
Vulnerabilities?

41. Patch Management

Ask:

How Are Security
Patches Prioritized?

Tested?

Deployed?

Tracked?

42. Penetration Testing

Ask:

Frequency

Scope

Independent Tester

Finding Severity

Retesting

43. Pen-Test Evidence

Request:

Executive Summary

Date

Scope

Critical Findings

Remediation Status

44. Secure Development Questions

For software providers ask about:

Secure SDLC

Threat Modeling

Code Review

SAST

DAST

SCA

Secrets Scanning

Pen Testing

45. Dependency Management

Ask:

Do You Maintain
an Inventory of
Software Dependencies?

46. SBOM

Ask:

Can You Provide
an SBOM
for the Product?

where relevant.

47. Open-Source Governance

Ask:

Are Open-Source
Components Approved?

Scanned?

Monitored?

Updated?

48. CI/CD Security

Ask:

Is MFA Required
for Source Control?

Are Branches Protected?

Are Builds Controlled?

Are Secrets Protected?

49. Artifact Integrity

Ask whether production artifacts are:

Signed

Verified

Traceable

50. Logging Questions

Ask whether the vendor logs:

Authentication

Administration

Data Access

Security Events

Configuration Changes

51. Log Retention

Ask:

How Long
Are Security Logs
Retained?

52. Monitoring Questions

Ask:

Do You Operate:

SOC?

SIEM?

MDR?

24×7 Monitoring?

53. Detection Coverage

Ask:

Which Systems
Are Monitored?

Production?

Cloud?

Endpoints?

Identity?

54. Incident Response Questionnaire

Ask:

Do You Maintain
an Incident Response Plan?

When Was It
Last Tested?

Who Participates?

How Are Customers
Notified?

55. Incident Notification

Ask:

What is your standard timeframe for notifying customers of a security incident affecting customer systems or data?

56. Incident Evidence

Request:

IR Policy

Tabletop Evidence

Customer Notification Procedure

57. Business Continuity Questions

Assess:

BCP

DR

RTO

RPO

Backup

Failover

Testing

58. RTO

Ask:

What Is the
Contractual or Tested
RTO for Our Service?

59. RPO

Ask:

What Is the
Maximum Expected
Data Loss?

60. DR Testing

Ask:

When Was the
Last DR Test?

Was Recovery
Successful?

Were Issues
Identified?

61. Backup Questions

Ask:

How Often
Are Backups Performed?

Encrypted?

Immutable?

Restore Tested?

How Long Retained?

62. Privacy Questionnaire

Create:

02 Vendor Privacy Questionnaire

Cover:

Personal Data

Sensitive Data

Purpose

Location

Retention

Deletion

Subprocessors

Data Subject Rights

Incidents

International Transfers

63. Personal Data

Ask:

What Categories
of Personal Data
Will You Process?

64. Processing Purpose

Ask:

For What Purpose
Will the Data
Be Processed?

65. Secondary Use

Ask:

Will Customer Data
Be Used for
Any Purpose Other Than
Providing the Service?

66. Data Location

Ask:

Which Countries
and Cloud Regions
Store or Process
Customer Data?

67. Retention

Ask:

How Long
Is Customer Data
Retained?

and:

What Starts
the Retention Period?

68. Deletion

Ask whether deletion covers:

Primary Data

Replicas

Archives

Backups

Logs

69. Data Subject Rights

Ask whether the vendor can support:

Access

Correction

Export

Restriction

Deletion

70. Subprocessors

Ask for:

Complete Subprocessor List

including:

Provider

Purpose

Country

Data

71. Subprocessor Change

Ask:

How Are Customers
Notified of
New Subprocessors?

72. Privacy Incident Notification

Ask:

How Quickly
Will You Notify Us
of an Incident
Involving Our
Personal Data?

73. Compliance Questionnaire

Create:

03 Vendor Compliance Questionnaire

Ask about applicable:

ISO 27001

SOC 1

SOC 2

PCI DSS

HIPAA

Privacy Certifications

Sector Requirements

74. Certification Details

Do not ask only:

Are You
ISO Certified?

Ask for:

Certificate

Scope

Entity

Locations

Expiry

Certification Body

75. SOC Report

Ask:

SOC Type?

Reporting Period?

Scope?

Exceptions?

Subservice Organizations?

76. CUECs

Ask the vendor to identify:

Complementary
User Entity Controls

that your organization must implement.

77. PCI DSS

Where payment services are involved:

What PCI DSS
Responsibilities
Do You Perform?

78. Cloud Vendor Questionnaire

For cloud providers assess:

Shared Responsibility

IAM

Regions

Encryption

Logging

Resilience

Customer Isolation

79. SaaS Vendor Questionnaire

For SaaS assess:

Tenant Isolation

SSO

MFA

Admin Access

Data Export

Retention

Deletion

Audit Logs

APIs

80. Tenant Isolation Question

Ask:

What technical controls prevent one customer tenant from accessing another customer’s data?

81. Customer Admin Controls

Ask:

Can Customers Configure:

SSO?

MFA?

Roles?

Logs?

Retention?

82. AI Vendor Questionnaire

Create:

04 AI Vendor Questionnaire

Cover:

Prompt Data

Uploaded Files

Model Training

Retention

AI Memory

Vector Data

Model Provider

Subprocessors

Output Security

Tenant Isolation

83. AI Training Question

Ask clearly:

Is customer data, prompts, files, outputs, or metadata used to train, fine-tune, evaluate, or improve any model?

84. AI Retention Question

Ask separately about:

Prompts

Outputs

Conversation History

Files

Embeddings

Logs

85. AI Model Provider

Ask:

Which Models
and Providers
Process Our Data?

86. AI Subprocessors

Ask about:

Model Providers

Embedding Providers

Cloud Hosting

Vector Services

Moderation Services

87. AI Isolation

Ask:

How Is Our Data
Separated from
Other Customers?

88. AI Deletion

Ask whether deletion removes:

Prompt

Output

Files

Vector Records

Embeddings

Conversation Memory

89. AI Output Security

Ask how the vendor prevents:

Cross-Tenant Leakage

Sensitive Output

Prompt Injection Impact

Unauthorized Retrieval

90. Evidence Requests

Every significant control response should be supported where appropriate.

Create:

05 Evidence Request Register

Use:

Question	Evidence Requested	Received	Reviewed	Result

91. Evidence Types

Examples:

Policy

Audit Report

Certificate

Configuration

Architecture

Pen-Test Summary

BCP Test

Screenshot

System Export

92. Evidence Strength

Not all evidence has equal strength.

Conceptually:

Vendor Statement
      ↓
Policy
      ↓
Configuration
      ↓
Independent Audit
      ↓
Technical Validation

Evidence strength depends on the control being assessed.

93. Validate Evidence Scope

Ask:

Does This Evidence
Apply to the
Service We Are Buying?

Example:

ISO Certificate

may cover:

Corporate Office

but not:

Cloud SaaS Platform

94. Evidence Freshness

Check:

Date

Audit Period

Version

Expiry

Current Environment

95. Response Validation Checklist

Create:

06 Response Validation Checklist

Verify:

Question Answered?

Evidence Provided?

Evidence Relevant?

Evidence Current?

Response Consistent?

Follow-Up Required?

96. Inconsistent Responses

Example:

Question 1:

MFA Required
for All Administrators?

Vendor:

Yes

Later answer:

Legacy Administrators
Use Password Only

This is a:

Response Conflict

and requires clarification.

97. Vendor Clarification

Use:

Question

Original Response

Evidence

Issue

Clarification Requested

98. Follow-Up Register

Create:

07 Vendor Clarification Tracker

Use:

Question	Issue	Sent	Due	Response	Status

99. Unanswered Questions

Possible statuses:

Answered

Not Applicable

Unknown

Unable to Provide

No Control

Do not allow:

Blank

to silently become:

Pass

100. “Not Applicable”

Vendor should explain why.

Example:

Question:
Database Encryption?

Vendor:

Not Applicable
because service
does not store
customer data.

Validate that this matches the service architecture.

101. “Unable to Provide”

This may mean:

Confidential Evidence

Control Not Documented

Vendor Restriction

Determine whether alternative evidence is available.

102. Red Flags

Potential questionnaire red flags include:

No MFA

No Penetration Testing

No Vulnerability Scanning

No Incident Plan

No BCP

Indefinite Retention

No Subprocessor Visibility

Unsupported Software

No Security Logs

No Encryption

No Privacy Rights Support

103. Additional High-Risk Red Flags

Shared Admin Accounts

Critical Findings Not Remediated

No Independent Assurance

No Security Owner

No Access Reviews

Provider Training on Customer Data

No Tenant Isolation Evidence

104. Questionnaire Scoring

Create:

08 Questionnaire Scoring Matrix

One simple model:

Compliant
= 0

Partial
= 1

Non-Compliant
= 2

Critical Gap
= 3

105. Weighted Questions

Not every question has equal risk.

Example:

Control	Weight
MFA	5
Encryption	5
Incident Response	5
Training	2
Policy Review	2

106. Weighted Score

Conceptually:

Control Gap
×
Risk Weight
=
Weighted Risk

A score should support:

Risk Analysis

not replace:

Professional Judgment

Example:

Overall Score:
Low

but one finding is:

No MFA
for Production Admins

The critical finding may override the aggregate score.

108. Critical Questions

Some questions should act as:

Approval Gates

Examples:

MFA for Admins

Encryption

Incident Notification

Tenant Isolation

Critical Vulnerability Handling

Data Deletion

depending on vendor risk.

109. Questionnaire Findings

Create:

09 Vendor Questionnaire Findings Register

Use:

Finding	Question	Risk	Severity	Owner	Due

110. Example Finding — MFA

Vendor response:

MFA
Optional
for Administrators

Finding:

Privileged vendor accounts are not consistently protected by multi-factor authentication.

Risk:

Administrative
Account Compromise

111. Example Finding — Retention

Vendor:

Customer Data
Retained Indefinitely

Finding:

The vendor has not established a defined retention period for customer data.

112. Example Finding — DR

Vendor:

DR Plan Exists

but:

Never Tested

Finding:

Disaster recovery capability has not been validated through periodic testing.

113. Example Finding — AI

AI provider:

Uses Prompt Data
to Improve Models

Potential finding:

Customer information may be used for secondary model-improvement purposes inconsistent with organizational privacy and confidentiality requirements.

114. Remediation Requests

For every material finding define:

Required Action

Vendor Owner

Due Date

Evidence

Priority

115. Vendor Remediation Tracker

Create:

10 Vendor Questionnaire Remediation Tracker

Use:

Finding	Action	Owner	Due	Evidence	Status

116. Compensating Controls

Where vendor cannot remediate immediately:

Customer-Side Controls

may reduce risk.

Examples:

Restrict Data Shared

IP Allowlisting

Customer-Managed Encryption

Reduced Privilege

Additional Monitoring

117. Residual Risk

After considering:

Vendor Controls

Remediation

Contract Controls

Customer Controls

Compensating Controls

determine:

Residual Vendor Risk

118. Decision Outcomes

Possible:

APPROVE

APPROVE WITH CONDITIONS

REMEDIATION REQUIRED

ESCALATE

REJECT

119. Approval Conditions

Example:

Approved with Conditions

conditions:

Enable MFA

Reduce Retention

Provide DR Evidence

Update Contract

Close Critical Findings

120. Questionnaire Evidence Pack

Create:

11 Vendor Questionnaire Evidence Pack

Suggested structure:

01 Vendor Intake

02 Inherent Risk

03 Questionnaire

04 Supporting Evidence

05 Clarifications

06 Scoring

07 Findings

08 Remediation

09 Residual Risk

10 Approval

121. Questionnaire Version Control

Maintain:

Questionnaire Version

Release Date

Control Changes

Owner

Example:

Vendor-Security-Questionnaire-v3.2

122. Why Versioning Matters

Questions may change because of:

New Threats

New Regulations

Cloud Adoption

AI Adoption

Control Improvements

123. Annual Questionnaire Review

Review:

Questions Still Relevant?

Duplicate Questions?

New Risks?

New Standards?

Vendor Feedback?

124. Questionnaire Libraries

Organizations may maintain multiple questionnaires:

Basic Vendor

Critical Vendor

Cloud Vendor

SaaS Vendor

Software Vendor

Privacy

AI Vendor

125. Modular Questionnaire Design

Instead of one:

500-Question
Master Questionnaire

use:

Core Questionnaire
+
Risk Modules

Example:

Core
+
Privacy
+
Cloud
+
AI

126. Example Questionnaire Logic

Vendor provides SaaS and processes personal data.

Assign:

Core Security

SaaS Security

Privacy

BCP

If AI functionality exists:

+
AI Module

127. Questionnaire Reuse

Existing valid evidence may sometimes reduce duplicate requests.

Example:

Current SOC 2
+
ISO 27001
+
Recent Assessment

may allow risk-based reduction of repeated questions.

128. Avoid Assessment Fatigue

Repeated questionnaires can create:

Vendor Fatigue

Improve efficiency through:

Risk-Based Scope

Evidence Reuse

Standardized Questions

Automation

129. Standard Questionnaires

Organizations may use industry questionnaires where appropriate.

Examples may include structured assessment frameworks designed for:

Security Assurance

Cloud Security

Financial Services

Privacy

But internal risk requirements should still determine whether additional questions are necessary.

130. Questionnaire Automation

Mature TPRM platforms can automate:

Questionnaire Distribution

Conditional Questions

Vendor Reminders

Scoring

Evidence Collection

Findings

Workflow

131. Automated Reminders

Example:

Day 0
Questionnaire Sent

Day 7
Reminder

Day 14
Escalation

Day 21
Business Owner
Escalation

132. Vendor Response SLA

Define expected turnaround based on:

Vendor Tier

Assessment Complexity

Procurement Timeline

133. Questionnaire Aging

Track:

0–15 Days

16–30 Days

31–60 Days

60+ Days

134. Vendor Questionnaire Metrics

Track:

Completion

Response Time

Evidence Coverage

Findings

Remediation

High-Risk Gaps

135. KPI — Questionnaire Completion

Questionnaires
Completed on Time
──────────────── × 100
Questionnaires Due

136. KPI — Evidence Coverage

Required Evidence
Received
─────────────── × 100
Required Evidence

137. KPI — Clarification Closure

Clarifications
Closed on Time
────────────── × 100
Clarifications Due

138. KPI — Finding Closure

Questionnaire Findings
Closed on Time
──────────────────── × 100
Findings Due

139. Vendor Questionnaire KRIs

Examples:

Critical Vendors
with Incomplete
Questionnaires

Critical Gaps

Missing Evidence

Unresolved Findings

Overdue Assessments

140. KRI — Critical Noncompliance

Vendors Approved
with Open
Critical Control Gaps

141. KRI — Missing Assurance

High-Risk Vendors
Without Supporting
Security Evidence

142. KRI — Stale Questionnaire

Critical Vendors
Whose Assessment
Is Past Review Date

143. Questionnaire Dashboard

Create:

12 Questionnaire Compliance Dashboard

Example:

Metric	Target
High-risk questionnaire completion	100%
Required evidence coverage	100%
Critical unanswered questions	0
Critical findings overdue	0
Vendor clarifications overdue	0
Current critical-vendor assessments	100%

144. Questionnaire Control Testing

GRC should periodically test questionnaire operations.

145. Test — Assessment Population

Vendors requiring questionnaires:

Completed:

Coverage:

108
─── × 100
120

= 90%

Potential finding:

12 Required
Vendor Assessments
Not Completed

146. Test — Evidence Coverage

Sample:

30 High-Risk
Questionnaires

Verify evidence for:

MFA

Encryption

Pen Test

BCP

Incident Response

147. Test — Validation

Sample:

25 Completed Assessments

Check whether reviewers:

Validated Evidence

Identified Conflicts

Requested Clarification

Documented Findings

148. Test — Critical Answers

Search for responses such as:

No MFA

No Encryption

No Backups

No Incident Plan

No Pen Test

Verify appropriate escalation occurred.

149. Test — Vendor Remediation

Sample:

40 Questionnaire Findings

Verify:

Owner

Due Date

Evidence

Status

Retest

150. Test — Approval

Verify vendors with:

Critical Gaps

were not approved without:

Remediation
or
Formal Risk Acceptance

151. Questionnaire Gap Register

Create:

13 Questionnaire Program Gap Register

Use:

Finding	Vendor / Process	Risk	Severity	Owner	Due

152. Example Program Finding

Policy:

All Tier 1 Vendors
Require Detailed
Security Questionnaire

Population:

30 Tier 1 Vendors

Complete:

Coverage:

80%

Finding:

Six critical vendors do not have current security questionnaires.

153. Root Cause

Why?

Assessments Overdue

Why?

No Automated
Reassessment Trigger

Why?

Questionnaires Managed
Through Spreadsheet

Root cause:

Questionnaire reassessment is not integrated with the vendor lifecycle-management workflow.

154. Correction

Complete Six
Outstanding Assessments

155. Corrective Action

Implement:

Vendor Tier
      ↓
Automatic Review Date
      ↓
Questionnaire Trigger
      ↓
Reminder
      ↓
Escalation

156. Practical Activity — SaaS Vendor

Use fictional vendor:

CloudCRM

CloudCRM:

Processes Customer PI

Hosted in Cloud

Has Subprocessors

Supports SSO

Provides APIs

Build questionnaire modules for:

Core Security

Privacy

SaaS

BCP

157. Practical Activity — Vendor MFA

Vendor answers:

MFA:
Yes

Evidence shows:

MFA Only
for VPN

but not:

Cloud Administrators

Document:

Response Conflict

Finding

Risk

Required Remediation

158. Practical Activity — SOC Report

Vendor questionnaire says:

Access Reviews
Performed Quarterly

SOC report identifies:

Access Review
Exceptions

Determine:

Follow-Up Question

Finding

Evidence

Residual Risk

159. Practical Activity — Privacy

Vendor states:

Customer Data
Deleted at Termination

but later says:

Backups Retained
Indefinitely

Identify:

Retention Conflict

Privacy Risk

Required Clarification

Contract Requirement

160. Practical Activity — AI Vendor

AI provider answers:

Customer Data
Is Not Sold

but terms state:

Data May Be Used
to Improve Services

Do not interpret:

Not Sold

as:

Not Used
for Model Training

Request explicit clarification.

161. Practical Activity — BCP

Critical vendor says:

DR Plan:
Yes

but:

Last Test:
Never

Determine:

Finding

Risk

Required Evidence

Approval Impact

Vendor Questionnaire Operational Checklist

Governance

questionnaire methodology defined.
questionnaires risk-tiered.
questionnaire owners assigned.
versions controlled.
periodic review established.

Scope

inherent risk confirmed.
vendor tier confirmed.
applicable modules selected.
privacy module added where required.
cloud module added where required.
AI module added where required.

Questions

questions are clear.
ambiguous wording removed.
control scope included.
frequency requested where relevant.
evidence requested for material controls.
conditional questions configured.

Security

governance assessed.
IAM assessed.
MFA assessed.
privileged access assessed.
encryption assessed.
network security assessed.
vulnerabilities assessed.
secure development assessed.
logging assessed.
incident response assessed.

Privacy

data categories identified.
purpose identified.
data locations identified.
retention reviewed.
deletion reviewed.
rights support reviewed.
subprocessors reviewed.
international transfers reviewed.

Resilience

BCP reviewed.
DR reviewed.
RTO assessed.
RPO assessed.
backup reviewed.
recovery testing reviewed.

Compliance

SOC evidence reviewed where applicable.
ISO evidence reviewed where applicable.
scope validated.
exceptions reviewed.
CUECs identified.
sector-specific requirements reviewed.

AI

prompt usage assessed.
training usage assessed.
model provider identified.
retention assessed.
subprocessors assessed.
vector data assessed.
deletion assessed.
tenant isolation assessed.

Evidence

evidence requested.
evidence received.
evidence current.
evidence relevant.
evidence scope confirmed.
restricted evidence protected.

Validation

inconsistent answers identified.
unanswered questions tracked.
N/A answers validated.
clarification obtained.
critical answers escalated.

Findings

findings documented.
severity assigned.
remediation defined.
owners assigned.
due dates defined.
compensating controls considered.

Risk Decision

score calculated where applicable.
critical findings reviewed separately.
residual risk assessed.
recommendation documented.
approval obtained.

Evidence Pack

intake retained.
questionnaire retained.
evidence retained.
clarifications retained.
scoring retained.
findings retained.
remediation retained.
decision retained.

162. Common Vendor Questionnaire Mistakes

Mistake 1 — Sending the Same Questionnaire to Everyone

Questionnaire depth should follow vendor risk.

Mistake 2 — Hundreds of Irrelevant Questions

More questions do not necessarily produce better assurance.

Mistake 3 — Yes / No Only

Do You Encrypt Data?
Yes

does not establish how, where, or with what controls.

Mistake 4 — No Evidence

Vendor self-attestation without supporting evidence provides limited assurance.

Mistake 5 — Evidence Collected but Never Reviewed

Attaching a SOC report is not the same as analyzing it.

Mistake 6 — No Conditional Logic

A low-risk vendor may receive irrelevant questions while important risk-specific questions are missed.

Mistake 7 — Blank Answer Means Pass

Missing responses should remain unresolved until assessed.

Mistake 8 — Trusting “Not Applicable”

N/A should include a defensible explanation.

Mistake 9 — Ignoring Contradictions

Questionnaire responses should be compared with supporting evidence and other answers.

A low aggregate score can hide one critical control failure.

Mistake 11 — No AI-Specific Questions

Traditional SaaS questionnaires may not address model training, prompt retention, embeddings, or AI memory.

Mistake 12 — Questionnaire Completed Once Forever

Vendor environments and risks change.

163. Weak Vendor Questionnaire Program

Spreadsheet
      ↓
200 Questions
      ↓
Vendor Says Yes
      ↓
Score
      ↓
Approve

164. Strong Vendor Questionnaire Program

Inherent Risk
      ↓
Vendor Tier
      ↓
Modular Questionnaire
      ↓
Control Questions
      ↓
Evidence
      ↓
Validation
      ↓
Clarification
      ↓
Risk Scoring
      ↓
Critical Finding Review
      ↓
Remediation
      ↓
Residual Risk
      ↓
Approval
      ↓
Periodic Reassessment

165. GRC Analyst Responsibilities

A GRC professional managing vendor questionnaires may:

maintain questionnaire libraries.
define risk-based questionnaire scope.
issue vendor assessments.
monitor response deadlines.
review vendor answers.
request supporting evidence.
validate security evidence.
compare responses with SOC and ISO evidence.
identify inconsistent answers.
request clarification.
score questionnaire results.
document findings.
assign severity.
coordinate remediation.
identify compensating controls.
calculate residual risk.
prepare vendor recommendations.
maintain evidence packs.
track reassessment dates.
monitor questionnaire KPIs and KRIs.

GRC connects:

Vendor Management

Procurement

Cybersecurity

Privacy

Legal

Cloud

Application Security

Business Continuity

AI Governance

Business Owners

Internal Audit

166. Vendor Questionnaire Maturity Model

Level 1 — Manual

Spreadsheet Questionnaire

Email Responses

Manual Review

Level 2 — Standardized

Questionnaire Templates

Risk Tiers

Evidence Requests

Scoring

Level 3 — Evidence-Based

Modular Assessments

Evidence Validation

Findings

Residual Risk

Approval Gates

Level 4 — Automated

Conditional Logic

Automated Distribution

Automated Reminders

Workflow

Dashboard

Level 5 — Continuous Vendor Assurance

Dynamic Risk

Continuous Evidence

Automated Control Validation

External Risk Signals

Questionnaire Reduction

Continuous Assurance

167. Vendor Questionnaire Mindset

For every questionnaire ask:

Why Are We
Asking This Question?

What Risk
Does It Address?

What Would
a Good Answer Look Like?

What Evidence
Would Prove It?

Does the Answer
Cover the Service
We Are Buying?

Is the Evidence
Current?

Does Another Answer
Contradict It?

Does the SOC Report
Contradict It?

Does "Yes"
Actually Cover
All Relevant Systems?

Is "Not Applicable"
Really Not Applicable?

Which Answers
Are Critical?

Which Gaps
Need Remediation?

Which Gaps
Can Be Compensated?

What Residual
Risk Remains?

Who Accepts
That Risk?

Can We Defend
the Approval Decision
with Evidence?

That is the practical enterprise mindset behind vendor questionnaires.

Key Takeaways

Vendor questionnaires are an important part of TPRM but are not complete due diligence by themselves.
Questionnaire depth should follow inherent risk and vendor tier.
Modular questionnaires are often more effective than a single massive questionnaire.
Good questions ask about control scope, implementation, frequency, and evidence.
Yes/no answers provide limited assurance without context.
Evidence should be reviewed for relevance, freshness, scope, and reliability.
Security questionnaires should cover governance, IAM, encryption, vulnerabilities, development, logging, incidents, and resilience.
Privacy questionnaires should cover data, purpose, location, retention, deletion, rights, and subprocessors.
Cloud and SaaS vendors require questions around shared responsibility and tenant isolation.
AI vendors require specific questions about model training, prompts, retention, embeddings, vector data, and model providers.
Contradictory answers should trigger clarification.
Unanswered questions and unsupported N/A responses should not automatically pass.
Questionnaire scores should support risk decisions, not replace professional judgment.
Critical control failures may override an otherwise acceptable aggregate score.
Findings should be linked to remediation, evidence, and residual risk.
Questionnaire programs should be version-controlled and periodically updated.
Mature organizations automate questionnaire distribution, evidence collection, workflow, and reporting.
GRC converts questionnaire responses into evidence-based vendor-risk decisions.

Knowledge Check

Before continuing, make sure you can answer:

What is a vendor questionnaire?
Where does it fit in the TPRM lifecycle?
Why is a questionnaire not complete due diligence?
Why should questionnaires be risk-tiered?
What is a modular questionnaire?
Why are yes/no questions often weak?
What should a strong security question capture?
Why is conditional logic useful?
What IAM areas should be included?
What should be asked about MFA?
What vulnerability-management areas should be assessed?
What evidence should support penetration testing?
What secure-development questions should software vendors answer?
Why should SBOMs be assessed?
What incident-response questions are important?
What should be assessed for BCP and DR?
What privacy questions should be included?
Why should subprocessors be identified?
What should be checked in a SOC report?
What are CUECs?
What should SaaS vendors explain about tenant isolation?
What questions should be asked of AI vendors?
Why should evidence scope be validated?
What should happen when questionnaire answers conflict?
How should unanswered questions be handled?
What is a questionnaire red flag?
Why can weighted scoring be useful?
Why should critical questions sometimes override the total score?
What belongs in a questionnaire evidence pack?
What role does GRC play in vendor questionnaire management?

What’s Next?

➡️ Next: 07 — Vendor Contracts

In the next lesson, you will move from assessing vendor controls through questionnaires and evidence to converting enterprise security, privacy, resilience, and compliance expectations into contractually enforceable obligations.

You will examine:

Vendor Risk
      ↓
Required Controls
      ↓
Contract Requirements
      ↓
Security Addendum
      ↓
Privacy / DPA Terms
      ↓
Incident Notification
      ↓
Audit Rights
      ↓
Subprocessor Requirements
      ↓
SLA / Resilience
      ↓
Data Retention
      ↓
Termination & Deletion
      ↓
Ongoing Enforcement

You will also build practical artifacts including a Vendor Contract Security Checklist, Security Addendum Requirements Matrix, Data Processing Agreement Checklist, Vendor Incident Notification Schedule, Audit Rights Matrix, SLA & Resilience Requirements, Contract Exception Register, Contract Renewal Review Checklist, and Vendor Contract Compliance Dashboard.