Vendor Risk Review: A Practical Questionnaire You Can Send Today : JustPlainSimple

Vendor reviews often stall because the questionnaire is too long or too vague. A good vendor review is short, focused, and aligned to the data the vendor will touch.

This guide provides a practical questionnaire you can send today, along with notes on how to interpret the answers.

How to use this questionnaire

Keep it short and only ask what you need.

Guidelines:

Send the full questionnaire only to vendors with sensitive data access.
Accept evidence in the form of SOC 2, ISO 27001, or policy docs.
Ask for a security contact and incident notification timeline.

Vendor risk questionnaire (short form)

Use the following sections as a template.

1. Company and scope

What service are you providing and what systems will you access?
What data will you store or process (PII, payment, health, other)?
Do you use subprocessors? If yes, list them.

2. Access and authentication

Do you enforce MFA for admin access?
How is access granted and revoked?
Do you use least-privilege roles for customer data?

3. Data protection

Is data encrypted at rest and in transit?
How are encryption keys managed?
What is your data retention and deletion policy?

4. Monitoring and logging

Do you log admin access to customer data?
How long are logs retained?
How do you detect unauthorized access?

5. Vulnerability management

How often do you patch production systems?
Do you run vulnerability scans or penetration tests?
Do you track and remediate critical issues?

6. Incident response

What is your incident response process?
What is your notification timeline for customers?
Do you have a dedicated security contact?

7. Business continuity

Do you have backups and a recovery plan?
How often are backups tested?
What is your RTO/RPO for critical systems?

8. Compliance and evidence

Do you have SOC 2, ISO 27001, or similar reports?
Can you provide a security policy overview?
Are there any recent security incidents we should know about?

How to interpret answers

Focus on risk, not perfection.

Practical approach:

Missing MFA or no incident response plan is a red flag.
Limited evidence is acceptable for early-stage vendors if access is low risk.
High-risk vendors should provide audit evidence or a clear remediation plan.

Simple scoring model

If you need a quick score, keep it lightweight.

Example scale:

3 = strong controls and evidence
2 = reasonable controls with partial evidence
1 = weak controls or missing evidence

Focus on low scores in access, encryption, and incident response.

Red flags to watch for

Some answers should pause the onboarding process.

Red flags:

No MFA for admin access
No incident response plan or notification timeline
No encryption for sensitive data
Refusal to share basic security evidence

Follow-up questions

If a response is vague, follow up with a short set of questions.

Follow-up examples:

Which systems are in scope for the reported controls?
How quickly are critical vulnerabilities patched?
Can you share the date of your last incident response test?

How to store vendor evidence

Evidence should be easy to find during renewals or audits.

Practical steps:

Store evidence in a shared, access-controlled folder
Tag each vendor with risk tier and review date
Set reminders for annual refresh

Example email template

Keep the request short and clear.

Example: “Hi team, we are reviewing vendors that access customer data. Please complete the short questionnaire attached and share any SOC 2 or ISO 27001 reports you have. If any answers are not applicable, note why. Thank you.”

When to escalate

Some vendors require a deeper review or a security call.

Escalation triggers:

The vendor handles sensitive data at scale
The vendor provides admin access to your systems
The vendor cannot provide basic security evidence

Keep reviews current

Vendor risk changes over time.