Template
Vendor security questionnaire
Use this working questionnaire before introducing a service to your team. It contains questions, not findings about a vendor. Adapt it to the data and workflow in scope; agree the review with the people responsible in your organisation.
Define the review
- Business workflow and data types:
- Product, plan, deployment and region:
- Business owner and security reviewer:
- Required decision date:
- Essential requirements and acceptance criteria:
How to use the spreadsheet
Download the CSV, open it in your spreadsheet and keep one copy for each scoped offer. Record the answer and the source or document, including its date and scope. Keep confidential documents in your approved workspace; record a reference rather than attaching them to a public page.
Use these review states:
- Unresolved: the answer or its supporting evidence is still open.
- Evidence received: material arrived but has not been assessed.
- Reviewed: the reviewer recorded whether it supports the requirement, including limitations.
- Not applicable: the reviewer recorded why the question does not apply.
A reviewed answer is not automatically an accepted control. Record the outcome and its reason in the follow-up field. Receiving a certificate does not resolve unrelated requirements; a missing public document does not show that a control is absent.
Questions and evidence
| ID | Area | Question | Evidence to request |
|---|---|---|---|
| SQ-01 | Scope | Which product, plan, deployment and region does this answer cover? | Proposed offer and service scope. |
| SQ-02 | Assurance | Which independent reports or certificates cover the proposed service, such as SOC 2 or ISO/IEC 27001? | Document, scope, period, exceptions and access conditions. |
| SQ-03 | Assurance | What testing supports the security statements and how are findings handled? | Test scope, date, assessor and remediation summary where available. |
| SQ-04 | Authentication | Which sign-in and multi-factor controls are available on the quoted plan? | Plan documentation and test-account result. |
| SQ-05 | Provisioning | How are users provisioned, changed and removed? | Supported methods, plan limits and access-removal test. |
| SQ-06 | Permissions | How are member, guest, administrator and service-account permissions restricted? | Role documentation and a representative permission test. |
| SQ-07 | Sharing | How can shared links and external access be restricted and revoked? | Configuration guide and revoked-link test. |
| SQ-08 | Audit logs | Which events can customers review and export, with what retention? | Event list, sample export, retention and plan conditions. |
| SQ-09 | Data protection | How is customer data protected in transit and at rest? | Documented scope, exclusions and key-management responsibilities. |
| SQ-10 | Data location | Where are primary data, backups and support access located? | Service-specific locations and selection conditions. |
| SQ-11 | Subprocessors | Which third parties process the proposed data and how are changes communicated? | Current subprocessor list, roles and change process. |
| SQ-12 | Incidents | How will we receive incident notifications and coordinate the response? | Contact route, service scope and proposed notification terms. |
| SQ-13 | Recovery | What can be restored, by whom, and what supports recovery objectives? | Recovery scope, objectives and dated test evidence. |
| SQ-14 | Vulnerabilities | How are vulnerabilities reported, prioritised and remediated? | Reporting route and documented handling process. |
| SQ-15 | Integrations | How are integration credentials scoped, rotated and revoked? | Connector documentation and a test of credential removal. |
| SQ-16 | Export | Can records, attachments and relationships be exported in usable formats? | Representative export, format details and known exclusions. |
| SQ-17 | Deletion | How are deletion requests and end-of-contract data handled, including backups? | Service-specific process, retention conditions and confirmation method. |
| SQ-18 | Ownership | Which controls must our team configure, operate and review? | Responsibility list, setup guide and named internal owner. |
Close the review
Record the outcome: proceed with conditions, request more evidence, or stop for a stated reason. Name the person accepting it, required configuration, accepted exceptions and a next review date. Assign each unresolved question an owner and a due date.
Repeat the relevant checks when the intended use, service scope or evidence changes. This is a working review aid, not a certification, exhaustive assessment or substitute for your organisation's requirements.
Continue the decision
- Follow the software security review checklist.
- Check documented security statements by product.
- Test the proposed workflow in a software pilot.
- Read the NCSC cloud security principles for a broader framework. This is an original working questionnaire, not an official NCSC form.
Copy the source (Markdown, select and copy)
# Vendor security questionnaire Use this working questionnaire before introducing a service to your team. It contains questions, not findings about a vendor. Adapt it to the data and workflow in scope; agree the review with the people responsible in your organisation. ## Define the review - Business workflow and data types: - Product, plan, deployment and region: - Business owner and security reviewer: - Required decision date: - Essential requirements and acceptance criteria: ## How to use the spreadsheet Download the CSV, open it in your spreadsheet and keep one copy for each scoped offer. Record the answer and the source or document, including its date and scope. Keep confidential documents in your approved workspace; record a reference rather than attaching them to a public page. Use these review states: - Unresolved: the answer or its supporting evidence is still open. - Evidence received: material arrived but has not been assessed. - Reviewed: the reviewer recorded whether it supports the requirement, including limitations. - Not applicable: the reviewer recorded why the question does not apply. A reviewed answer is not automatically an accepted control. Record the outcome and its reason in the follow-up field. Receiving a certificate does not resolve unrelated requirements; a missing public document does not show that a control is absent. ## Questions and evidence | ID | Area | Question | Evidence to request | | --- | --- | --- | --- | | SQ-01 | Scope | Which product, plan, deployment and region does this answer cover? | Proposed offer and service scope. | | SQ-02 | Assurance | Which independent reports or certificates cover the proposed service, such as SOC 2 or ISO/IEC 27001? | Document, scope, period, exceptions and access conditions. | | SQ-03 | Assurance | What testing supports the security statements and how are findings handled? | Test scope, date, assessor and remediation summary where available. | | SQ-04 | Authentication | Which sign-in and multi-factor controls are available on the quoted plan? | Plan documentation and test-account result. | | SQ-05 | Provisioning | How are users provisioned, changed and removed? | Supported methods, plan limits and access-removal test. | | SQ-06 | Permissions | How are member, guest, administrator and service-account permissions restricted? | Role documentation and a representative permission test. | | SQ-07 | Sharing | How can shared links and external access be restricted and revoked? | Configuration guide and revoked-link test. | | SQ-08 | Audit logs | Which events can customers review and export, with what retention? | Event list, sample export, retention and plan conditions. | | SQ-09 | Data protection | How is customer data protected in transit and at rest? | Documented scope, exclusions and key-management responsibilities. | | SQ-10 | Data location | Where are primary data, backups and support access located? | Service-specific locations and selection conditions. | | SQ-11 | Subprocessors | Which third parties process the proposed data and how are changes communicated? | Current subprocessor list, roles and change process. | | SQ-12 | Incidents | How will we receive incident notifications and coordinate the response? | Contact route, service scope and proposed notification terms. | | SQ-13 | Recovery | What can be restored, by whom, and what supports recovery objectives? | Recovery scope, objectives and dated test evidence. | | SQ-14 | Vulnerabilities | How are vulnerabilities reported, prioritised and remediated? | Reporting route and documented handling process. | | SQ-15 | Integrations | How are integration credentials scoped, rotated and revoked? | Connector documentation and a test of credential removal. | | SQ-16 | Export | Can records, attachments and relationships be exported in usable formats? | Representative export, format details and known exclusions. | | SQ-17 | Deletion | How are deletion requests and end-of-contract data handled, including backups? | Service-specific process, retention conditions and confirmation method. | | SQ-18 | Ownership | Which controls must our team configure, operate and review? | Responsibility list, setup guide and named internal owner. | ## Close the review Record the outcome: proceed with conditions, request more evidence, or stop for a stated reason. Name the person accepting it, required configuration, accepted exceptions and a next review date. Assign each unresolved question an owner and a due date. Repeat the relevant checks when the intended use, service scope or evidence changes. This is a working review aid, not a certification, exhaustive assessment or substitute for your organisation's requirements. ## Continue the decision - [Follow the software security review checklist](/buying-guides/software-security-review). - [Check documented security statements by product](/security). - [Test the proposed workflow in a software pilot](/buying-guides/software-pilot). - [Read the NCSC cloud security principles](https://www.ncsc.gov.uk/collection/cloud/the-cloud-security-principles) for a broader framework. This is an original working questionnaire, not an official NCSC form.