Rampwire / Guides

The 30 Questions on (Almost) Every Security Questionnaire

Updated October 2026 · 6 min read

Despite looking different, vendor security questionnaires draw from a remarkably small pool. Prepare written answers for the questions below and you will recognize 80% of what any buyer sends.

Company & compliance basics

  1. Do you have a documented information security program?
  2. Do you hold SOC 2 / ISO 27001 certification? Type and dates?
  3. When was your most recent penetration test, and were findings remediated?
  4. Do you carry cyber liability insurance? What coverage limits?
  5. Have you experienced a reportable security incident or breach in the last 3 years?

Data handling

  1. Where is customer data stored and processed?
  2. Is customer data encrypted at rest and in transit? Which algorithms?
  3. Do you share a database instance between customers (multi-tenancy isolation)?
  4. What is your data retention and deletion policy?
  5. Will you sign our data processing agreement (DPA)?
  6. How is data disposed of at contract termination?

Access control

  1. Is access to production systems gated by SSO and MFA?
  2. Describe your least-privilege and access review processes.
  3. How quickly is access revoked after offboarding?
  4. Do employees use password managers and full-disk encryption?

People & process

  1. Do you run security awareness training? How often?
  2. Do you perform background checks on employees with data access?
  3. Describe your incident response plan and customer notification timelines.
  4. Do you have a business continuity / disaster recovery plan? Is it tested?

Engineering practices

  1. How are vulnerabilities managed and patched? What SLAs?
  2. Is code reviewed before deployment? Are deployments audited?
  3. Do you separate development, staging, and production environments?
  4. Is customer data ever used in non-production environments?
  5. Do you rely on automated dependency and container scanning?

Subprocessors & vendors

  1. List all subprocessors that touch customer data.
  2. How do you evaluate and contract subprocessors?
  3. How will we be notified of subprocessor changes?

The hard tail

  1. Describe your logical network architecture and segmentation.
  2. Do you support customer-managed encryption keys?
  3. What logs are collected, and can they be exported to our SIEM?

Prepare once, reuse forever

Write a canonical answer for each of these in your own words, grounded in your actual practices. Keep it in a living document, or load it into Rampwire, which drafts every future questionnaire from that library and flags the questions your documentation can't yet answer.

Why do questionnaires repeat the same questions?

Most procurement teams adapt templates from CIS, CAIQ (Cloud Security Alliance), or SIG Lite, so questions converge on the same control areas: compliance status, data handling, access control, people, engineering, and subprocessors.

What is the hardest section for small companies?

Certifications and formal audit questions. If you have no SOC 2 or ISO 27001, answer honestly, describe compensating controls, and share your roadmap. Fabrication here is a deal-killer discovered in due diligence.

Tired of answering these by hand?

Rampwire drafts grounded answers from your own policies, with citations and confidence flags.

Start free