Vendor Security Questionnaire Template
A free vendor security questionnaire for IT and security teams. Ask each software vendor how they protect your data, and collect their security reports.
Customize the pages and design to fit your needs.
About this template
Send one vendor security assessment to every new software vendor. Collect the data they'll access, hosting, encryption, sign in security, certifications, breach notice and subprocessors, plus their reports, before you sign.
Common uses
- IT and security teams vetting vendors
- SaaS buyers before signing
- MSPs reviewing client tools
Key features
- Hosting, encryption and sign in checks
- Report and policy uploads
- Signed confirmation
What this template asks
What's your company name?
Short Text
What's your name and job title?
Short Text
What's your work email?
Email
Which product or service is this for?
Short Text
Which of our data will you access or store?
Multiple Choice · Customer personal data, Employee data, Financial data, Login credentials, Source code, No sensitive data
Where is our data hosted?
Single Choice · AWS, Google Cloud, Microsoft Azure, Your own data centers, Another provider
Which countries is the data stored in?
Short Text
Is data encrypted at rest and in transit?
Yes / No
Do your staff use multi factor sign in for all systems?
Yes / No
Which security reports or certifications do you have?
Multiple Choice · SOC 2 Type II, SOC 2 Type I, ISO 27001, Penetration test in the last 12 months, None yet
How soon would you tell us about a data breach?
Single Choice · Within 24 hours, Within 72 hours, Within 7 days, No set time
Do you have a written incident response plan?
Yes / No
List any subprocessors that will handle our data
Long Text · Optional
Upload your security report or policies
File · Optional
Sign to confirm your answers are accurate
Signature
How to use this template
Copy it
Select Use template and a copy opens in your workspace as an unpublished draft.
Make it yours
Edit any question or answer, choose a theme, and add your logo.
Share it
Publish, then send the link, show a QR code, or embed the form on your site. Responses arrive in Submissions.
Frequently asked questions
What is a vendor security questionnaire?
It's a set of questions you send a software vendor before you buy, to learn what data they touch, how it's protected and how they handle a breach.
Can vendors upload their SOC 2 report?
Yes. There's an upload for security reports and policies, saved with each response.
Can I make it longer for high risk vendors?
Yes. Use conditional logic to show extra questions when a vendor will handle personal or financial data, and keep it short for low risk tools.