# Vendor Security Questionnaire Template

> A free vendor security questionnaire for IT and security teams. Ask each software vendor how they protect your data, and collect their security reports.

Send one vendor security assessment to every new software vendor. Collect the data they'll access, hosting, encryption, sign in security, certifications, breach notice and subprocessors, plus their reports, before you sign.

Canonical: https://reuily.com/templates/vendor-security-questionnaire
Use this template: https://reuily.com/form/from-template/vendor-security-questionnaire
Collections: Requests & Intake, SaaS, IT & Tech Support, Operations
Last updated: 2026-10-24

## Questions

- Question 1: What's your company name? (Short Text, required)
- Question 2: What's your name and job title? (Short Text, required)
- Question 3: What's your work email? (Email, required)
- Question 4: Which product or service is this for? (Short Text, required)
- Question 5: Which of our data will you access or store? (Multiple Choice, required). Options: Customer personal data; Employee data; Financial data; Login credentials; Source code; No sensitive data
- Question 6: Where is our data hosted? (Single Choice, required). Options: AWS; Google Cloud; Microsoft Azure; Your own data centers; Another provider
- Question 7: Which countries is the data stored in? (Short Text, required)
- Question 8: Is data encrypted at rest and in transit? (Yes / No, required)
- Question 9: Do your staff use multi factor sign in for all systems? (Yes / No, required)
- Question 10: Which security reports or certifications do you have? (Multiple Choice, required). Options: SOC 2 Type II; SOC 2 Type I; ISO 27001; Penetration test in the last 12 months; None yet
- Question 11: How soon would you tell us about a data breach? (Single Choice, required). Options: Within 24 hours; Within 72 hours; Within 7 days; No set time
- Question 12: Do you have a written incident response plan? (Yes / No, required)
- Question 13: List any subprocessors that will handle our data (Long Text, optional)
- Question 14: Upload your security report or policies (File, optional)
- Question 15: Sign to confirm your answers are accurate (Signature, required)

Signing records the signer's consent, email, IP address, browser and signing time, and each signer can download a signed PDF copy.

## Common uses

- IT and security teams vetting vendors
- SaaS buyers before signing
- MSPs reviewing client tools

## Key features

- Hosting, encryption and sign in checks
- Report and policy uploads
- Signed confirmation

## Frequently asked questions

### What is a vendor security questionnaire?

It's a set of questions you send a software vendor before you buy, to learn what data they touch, how it's protected and how they handle a breach.

### Can vendors upload their SOC 2 report?

Yes. There's an upload for security reports and policies, saved with each response.

### Can I make it longer for high risk vendors?

Yes. Use conditional logic to show extra questions when a vendor will handle personal or financial data, and keep it short for low risk tools.