The vendor security questionnaire, and who gets one

The register behind it is the part an auditor asks for. Requests 17 through 19 on a SOC 2 evidence request list are all vendor questions: the listing, the assurance you obtained, and the risk assessment you ran before data started flowing. Answering those later is archaeology. Answering them as you onboard is a spreadsheet.

Tier by what the vendor can reach

Spend is the wrong axis. A logging tool you barely notice on the invoice holds every request header your application emits, while a large contract for office furniture reaches nothing. Rank vendors by reach. Three tiers is enough, and the tier sets the questionnaire length and the clock on the next review.

The 24 questions

Grouped by section, numbered straight through, so you can paste the whole set into one email or split the sections across owners. Every question is answerable in a sentence or with a document name. None asks a vendor to describe a philosophy.

A. Company and scope

1. What is your legal entity name, and where is the company registered?
2. Which of your products will we use, and what does it do with our data?
3. Who is the named security contact, and what is the escalation address?

B. Assurance

4. Do you hold a current SOC 2 Type 2 report, and what period does it cover?
5. Which criteria are in scope, and which subservice organizations are carved out?
6. If that period ended over three months ago, can you send a bridge letter?
7. When was your last penetration test, and can we see the summary?

C. Our data

8. What categories of our data will you store, and in which countries?
9. Is our data encrypted in transit and at rest, and with what?
10. How is our data separated from another customer’s inside your systems?
11. What is your retention period after termination, and how is deletion confirmed?
12. Which of your staff can read our production data, and who approves that?

D. Access and change

13. Is multi factor authentication enforced for every employee on your production console?
14. Do you offer single sign on to our users, and at which plan level?
15. How is access removed when an employee leaves, and within how long?
16. How are production changes reviewed and approved before they ship?

E. Incidents and people

17. Have you had a security incident affecting customer data in the last 24 months?
18. How fast do you notify us after confirming a breach, in hours or days?
19. Do you run background checks on staff with production access?
20. Do staff complete security training, and how often?

F. Subprocessors and continuity

21. Which subprocessors handle our data, and where is that list published?
22. How much notice do we get before a new subprocessor is added?
23. What are your recovery time and recovery point targets, and when was the last restore test?
24. Do you carry cyber liability insurance, and at what limit?

The questions that waste both sides’ time

Cut these three. Each reliably produces an answer, and the answer changes nothing you would then do.

Do you have an information security policy?

The answer is yes, and it costs four seconds to give. Ask for the specific control you care about, which is question 15.

Describe your security culture.

Nothing in the answer can later turn out to have been wrong. A question you cannot be lied to on carries no information.

Anything the report they already sent you answers.

Read it first. Making a vendor retype their own Section 4 into your form buys you nothing the PDF already said.

When the vendor sends a report instead of answering

This is the good outcome. A report carries evidence a licensed CPA firm tested against stated criteria.¹ A questionnaire carries what the vendor says about itself. Take the report, then do three things with it.

1. Check that it is real and current. Signature, period, scope, exceptions. How to verify a SOC 2 report you were sent is the read order.
2. Read the complementary user entity controls. That section is a list of jobs assigned to you.² If the vendor assumes you rotate the key and you never do, neither control holds. Complementary user entity controls covers the rest.
3. Ask only what the report leaves open. It describes the vendor system, not your contract, so questions 8, 11, 14, 21 and 24 stay on your list.

Record the review as a dated note naming who read it and what they concluded. A report in a folder is not evidence that anyone read it.

When a critical vendor has no report

No report is not a veto. It is a reason to get the same assurance elsewhere, and to write down exactly what you accepted and why.

1. Get all 24 answers in writing, from a named person, dated. An email thread counts. A call does not.
2. Ask for what they do have. A penetration test summary, an ISO 27001 certificate.
3. Move the rest into the contract. A breach notification window in hours, a deletion duty on termination, subprocessor notice, and the right to re-assess.
4. Write the exception down and date it. Name the vendor, the gap, who accepted it, and when you will look again.

Your own examination looks at your vendor management, not at your vendor. The artifact that matters is your record of the decision, not the paperwork the vendor never had.

How often to re-assess

Cadence by tier, and the table above sets the interval. What a table cannot show is timing: land the Tier 1 review after the vendor report period ends, or you spend it reading last year’s coverage.

Four events beat any schedule: the product you bought starts touching customer data and moves the vendor up a tier, their report period lapses with no bridge letter, they announce a breach, or they add a subprocessor that handles data you gave them. Any of those pulls the review forward, whatever the register says.