Survey Templates B2B Surveys Vendor Security and Assessment Sample Questionnaire Template

Vendor Security and Assessment Sample Questionnaire Template

The vendor security and assessment questionnaire template is an in-depth questionnaire that is used to bring on or evaluate an existing vendor. This questionnaire has been created by vendor management and sourcing specialists and can be tweaked to collect important data about a vendor that can help to assess if the vendor fits into your organization's plans and what are their security policies. This survey template consists of vendor identifying questions as well as other survey questions that collects in-depth data about their data management policies, methods to safeguard personally identifying information (PII), proactive and reactive security policies and specific policies to manage user data like GDPR compliance.

use this free template

Preview this template

Vendor Assessment

Company name

Date of establishment

Registered address

Trading address (if different from the registered address)

Telephone

Fax

Company registration number

Company VAT number

Company D&B number

What is the legal status of your organization?

Sole proprietorship

Partnership

Private corporation

S Corporation

Limited Liability Company (LLC)

Charity

Non-profit

Cooperative

Please state your revenue for the last year:

Please state your revenue for the last 3 years:

Vendor Security

Name of application being provided

Description of application being provided

What is the technology stack for the application? Select all that apply:

AWS

MySQL

Ruby on Rails

Javascript

Other

The services you run are provided from:

Own data-centers

Cloud

On-premise deployment

Other

What is your software delivery method?

On-premise

Hosted

Multi-tenant

Anything-as-a-service (XaaS)

Other

Please state the access methods to your application:

Features are available only post an individual login interface

There is an administration interface along with the regular or individual login interface

There is a complex user management and rule management for individual users

Other

Do you use unit tests or similar tests for your internal production testing?

Yes

Please state your agreement with the below statements:

	Strongly disagree	Disagree	Neutral	Agree	Strongly agree
We maintain process documents	Strongly disagree	Disagree	Neutral	Agree	Strongly agree

We maintain design flow documents	Strongly disagree	Disagree	Neutral	Agree	Strongly agree

We maintain data flow documents	Strongly disagree	Disagree	Neutral	Agree	Strongly agree

We maintain data architecture documents	Strongly disagree	Disagree	Neutral	Agree	Strongly agree

We encrypt all of the user data	Strongly disagree	Disagree	Neutral	Agree	Strongly agree

We have a methodology to process and protect personally identifiable data	Strongly disagree	Disagree	Neutral	Agree	Strongly agree

We conduct internal audits	Strongly disagree	Disagree	Neutral	Agree	Strongly agree

We conduct third-party external audits	Strongly disagree	Disagree	Neutral	Agree	Strongly agree

We have processes and procedures in place to deal with security incidents	Strongly disagree	Disagree	Neutral	Agree	Strongly agree

We have clearly defined network guidelines	Strongly disagree	Disagree	Neutral	Agree	Strongly agree

	Strongly disagree	Disagree	Neutral	Agree	Strongly agree
We maintain a fixed backup cycle	Strongly disagree	Disagree	Neutral	Agree	Strongly agree

We have a review policy for physical and environmental exigencies	Strongly disagree	Disagree	Neutral	Agree	Strongly agree

How long do you store user data for?

Store and backup data only till the life of the project

Upto 6 months

Upto 12 months

1-2 years

2 years +

How do you deploy product or service upgrades?

Central patch deployments

Localized patch deployments

Internal team upgrades

Vendor team upgrades

Third-party upgrades

Other

Please state your level of security preparedness

Very strong - we monitor systems 24*7

Medium - we get involved when we notice an excessive increase in usage or access from external and unlicensed sources

Low - we action on security breaches when the client logs a ticket

Is there an escalation matrix for any security breaches?

Yes

For the provision of services, do you follow country/region specific security policies to manage user data and personally identifying information (PII)?

Yes

Are you GDPR compliant?

Yes

Do you have a formal Information Security Program (InfoSec SP) in place?

Yes

Do your information security and privacy policies align with any of the below industry standards?

ISO-27001

NIST cyber-security framework

ISO-22307

CoBIT

Other

Please state your policies on proactive security?

Please state your policies on reactive security?

Please state your policies on customer facing application security?

Is there any other feedback you would like to provide?

use this free template

Vendor Security and Assessment Sample Questionnaire Template

Related templates and questionnaires

Client Evaluation of Company Services Survey Questions

Supplier Service Evaluation Survey Template

Business to Business Demographics Survey Template

QuestionPro in your language

Awards & certificates

The Experience Journal