Vendor Risk Assessment Questionnaire: Question Bank

Last updated: 16 October 2026

Quick answer: A vendor risk assessment questionnaire is a structured set of questions you send to a supplier to test its security, privacy, resilience and governance before and during the relationship. Good questionnaires are tiered by vendor risk, ask for evidence rather than yes/no claims, and map each answer to the legal or contractual requirement it supports.

Every risk team has seen it: a 300-question spreadsheet sent to a stationery supplier, and a two-page form sent to the cloud provider that hosts customer data. A vendor risk assessment questionnaire only works when the depth of questioning matches the risk the vendor brings.

This guide explains what regulators in the EU, UK and US expect from supplier due diligence, how to tier vendors, which questions to ask in each domain, and how to score the answers.

What is a vendor risk assessment questionnaire?

It is the main data-gathering tool in third-party risk management. You use it to collect a supplier’s own description of its controls, then verify the important answers with evidence, certifications or audits.

A questionnaire is not the whole assessment. It sits alongside contract review, external security ratings, financial checks and, for critical vendors, on-site or remote audits.

In practice: The questionnaire is only as good as the follow-up. Decide before you send it which answers will trigger a request for evidence, a remediation action or an escalation to the risk owner.

Why do regulators expect vendor due diligence?

Because most major laws make you accountable for the suppliers you choose. The questionnaire is how you show that the choice was informed.

• GDPR: Article 28(1) of the GDPR says a controller shall use only processors “providing sufficient guarantees” of appropriate technical and organisational measures. Article 28(3) lists what the processing contract must contain.
• NIS2: Article 21(2)(d) of the NIS2 Directive requires supply chain security measures, and Article 21(3) asks entities to consider each direct supplier’s vulnerabilities, product quality and cybersecurity practices, including secure development.
• DORA: Since 17 January 2025, Article 28(4) of DORA requires financial entities, before contracting for ICT services, to assess risks including concentration risk, carry out due diligence on the provider’s suitability and identify conflicts of interest. Each arrangement must also be recorded in the register of information, covered in our DORA register of information guide.
• US financial institutions: The FTC Safeguards Rule, 16 CFR 314.4(f), requires covered businesses to select capable service providers, bind them by contract and periodically assess them “based on the risk they present”.

EU vs UK vs US: what drives supplier questionnaires

For framework detail, see our overviews of GDPR requirements and DORA compliance, and our article on vendor risk as executive liability.

How should you tier vendors before sending a questionnaire?

Tier vendors by inherent risk first, then send a questionnaire sized to that tier. This keeps effort proportionate and matches the “based on the risk they present” wording that regulators use.

Use a short intake form, completed by the business owner, to answer five questions:

1. Will the vendor access, store or process personal data? Special category or health data?
2. Will it connect to your network, systems or production environment?
3. Does it support a critical or important business function, or a regulated service?
4. How hard would it be to replace, and how long could you operate without it?
5. Where will it process data, and does it rely on its own subcontractors?

The frequencies above are a common starting point, not a legal requirement. Set your own in your third-party risk policy. Note also that the Commission proposed targeted NIS2 amendments in January 2026; until they are adopted, Article 21 applies as written.

Vendor risk assessment questionnaire: question bank by domain

Adapt these questions to each tier. Each asks for something you can verify. Where possible, ask the vendor to attach evidence rather than tick a box.

1. Governance and certifications

• Which security or privacy certifications or attestations do you hold (for example ISO 27001, SOC 2 Type II)? Provide the certificate or report and its scope.
• Who is accountable for information security and data protection? Do you have a DPO where required?
• When were your security policies last approved by management?

2. Data protection and privacy

• Which categories of personal data will you process for us, and for what purposes?
• Where will the data be stored and accessed from? List any transfers outside the EEA or UK and the safeguards used.
• Which sub-processors will be involved, and how will you notify us of changes?
• How do you support data subject requests and return or delete data at contract end?

3. Access control and identity

• Is multi-factor authentication enforced for all remote and privileged access?
• How often are user and privileged access rights reviewed? Provide the last review record.
• How is access removed when staff leave?

4. Security operations

• How are vulnerabilities identified and patched? What are your target timescales by severity?
• When was your last independent penetration test? Share the executive summary and remediation status.
• Is data encrypted in transit and at rest? Who manages the keys?
• How are logs collected, retained and monitored?

5. Secure development (software vendors)

• Describe your secure development life cycle, including code review and testing.
• How do you manage open-source components and third-party libraries?
• How do you handle vulnerability reports from customers or researchers?

6. Incident management and breach notification

• How quickly will you notify us of a security incident or personal data breach affecting our data?
• Who is our point of contact during an incident, and what information will you provide?
• Describe a significant incident in the last 24 months and the lessons learned.

7. Resilience and exit

• What are your recovery time and recovery point objectives for the services we use? When were they last tested?
• Do you depend on a single cloud provider or region?
• What support will you provide to transfer data and services at exit?

8. Fourth parties

• List the subcontractors critical to delivering our service.
• How do you assess their security and privacy controls?

Common mistake: Asking “Do you have an incident response plan?” Almost everyone answers yes. Ask instead for the notification timescale, the last test date and the contact route. Those answers can be compared, verified and written into the contract.

Running this question bank across dozens of suppliers is where spreadsheets break down. You can start your 14-day free trial of Enactia’s vendor and third-party risk management module to send tiered questionnaires, collect evidence and track remediation in one place.

How do you score questionnaire answers?

Score each answer on how well it reduces risk, weight the domains that matter most for that vendor, and combine the result with inherent risk to get residual vendor risk.

A simple, defensible model:

• Answer scores: 0 = no control, 1 = partial or undocumented, 2 = implemented, 3 = implemented and independently evidenced.
• Weights: for a payroll provider, data protection and access control carry more weight; for a hosting provider, resilience and security operations do.
• Red flags: define answers that fail the assessment regardless of total score, for example no MFA on administrative access, or refusal to sign a processing agreement.
• Residual rating: combine inherent tier and control score into low, medium, high or unacceptable, and require the risk owner to accept anything above your appetite.

Worked example

A marketing agency will process your customer email list. Intake places it in the High tier because it handles personal data. Its questionnaire shows MFA and encryption in place (score 3 with evidence), but no sub-processor list and a vague “without undue delay” breach notification commitment (score 1 each). Result: medium residual risk, approved with two conditions written into the contract: a sub-processor list with change notification, and breach notification to you within a fixed number of hours so you can meet your own 72-hour GDPR deadline.

If you already assess controls against ISO 27001 or NIS2, the same scoring logic can feed your wider enterprise risk register, so vendor risk appears alongside your other risks rather than in a separate silo.

How can you reduce questionnaire fatigue?

Ask less, reuse more. Vendors receive the same questions from many customers, and response quality drops when forms are long and generic.

• Accept existing evidence. A current SOC 2 Type II report or ISO 27001 certificate with the right scope can replace large sections of your questionnaire. Review the scope, exceptions and bridge letters rather than asking again.
• Use standard question sets. Industry questionnaires and the NCSC supply chain security principles give you a structure suppliers already recognise.
• Map once, use many times. Map each question to the requirements it supports, such as GDPR Article 28, NIS2 Article 21 or DORA Article 28, so one answer satisfies several frameworks. Enactia’s Compliance Universe does this cross-mapping automatically.
• Pre-fill what you know. Contract details, service scope and previous answers should not be re-entered each year.

For US federal suppliers and larger programmes, NIST SP 800-161 Rev. 1 offers a detailed model for cybersecurity supply chain risk management that many private organisations borrow from.

What happens after the questionnaire?

The answers should drive a decision, contract terms and a monitoring plan.

1. Decide: approve, approve with conditions, or reject. Record who decided and why.
2. Contract: turn weak answers into obligations, for example notification times, audit rights and exit support. DORA Article 30 lists mandatory terms for ICT contracts with financial entities.
3. Remediate: agree actions and deadlines with the vendor and track them.
4. Monitor: reassess on schedule and on triggers such as a breach, acquisition or change of service.
5. Exit: keep a plan for critical vendors, including data return and deletion.

Key takeaways

• A vendor risk assessment questionnaire gathers evidence of a supplier’s controls; it should be tiered by inherent risk.
• GDPR, NIS2, DORA and the FTC Safeguards Rule all expect risk-based supplier due diligence.
• Ask for timescales, dates and documents, not yes/no answers.
• Score answers, define red flags and have the risk owner accept residual risk.
• Reuse certifications and map questions across frameworks to cut effort for you and your vendors.

Frequently asked questions

How many questions should a vendor risk questionnaire have?
It depends on the tier. Low-risk vendors may need only an intake form, medium-risk vendors around 20-30 targeted questions, and critical vendors a full question bank with evidence. Length is less important than relevance: every question should link to a risk you care about or a requirement you must meet.

Can a SOC 2 report replace a vendor questionnaire?
Partly. A current SOC 2 Type II or ISO 27001 certification can replace many security questions, provided the scope covers the service you buy. You will still need questions on data locations, sub-processors, breach notification terms, exit support and any requirement the report does not address.

How often should vendors be reassessed?
Reassess on a risk basis. Many organisations review critical and high-risk vendors annually and lower tiers every two years or at renewal. Also reassess after trigger events such as a reported breach, a merger, a change of hosting location or a significant expansion of the services or data involved.

Who should own the vendor risk assessment?
The business owner who wants the vendor should own the relationship and the residual risk decision. Security, privacy, legal and procurement contribute expertise and review specific domains. A central third-party risk function usually runs the process, keeps the inventory and makes sure reassessments happen on time.

Is a vendor questionnaire required by GDPR?
GDPR does not mandate a questionnaire, but Article 28(1) requires controllers to use only processors providing sufficient guarantees. A documented assessment, often a questionnaire with evidence, is the most practical way to show you checked those guarantees before signing, as the accountability principle expects.

Conclusion: ask fewer, better questions

A good vendor risk assessment questionnaire is short where risk is low, deep where it is high, and always tied to evidence and decisions. Tier first, ask for proof, score consistently and turn gaps into contract terms.

Enactia’s AI-powered GRC platform brings vendor tiering, questionnaires, evidence and cross-framework mapping into one workflow. Contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.