A Free Vendor Security Questionnaire Template (40 Questions)

Updated October 2026 · 6 min read

Whether you're sending a questionnaire to your own vendors or receiving yet another one, this template covers the standard control areas without ballooning to 300 questions. Copy it, trim it, use it.

Section A: Compliance & governance (6)

Describe your information security program and who owns it.
List certifications (SOC 2, ISO 27001) with scope and dates.
When was your last independent penetration test? Outcome?
Do you maintain cyber liability insurance? Limits?
Reportable incidents or breaches in the past 36 months?
Do you maintain written security policies? How often are they reviewed?

Section B: Data protection (8)

Where is customer data stored and processed (regions)?
Encryption at rest and in transit: which algorithms and key management?
Tenant isolation model (shared / dedicated)?
Retention periods and deletion process at contract end?
Subprocessors with data access: list them and describe your review process.
Will you execute our DPA?
Do you support data export in a standard format?
Is customer data used for model training or product analytics?

Section C: Access & identity (6)

SSO and MFA enforcement for production access?
Access provisioning/review/offboarding process?
Privileged access management and session logging?
Background checks for personnel with data access?
Security awareness training frequency?
Contractor access controls?

Section D: Engineering & operations (10)

Environment separation (dev/staging/prod)?
Is customer data used outside production?
Code review and deployment approval process?
Dependency/vulnerability scanning and patch SLAs?
Secrets management approach?
Logging, monitoring, and alerting on security events?
Backup frequency, encryption, and restore testing?
Incident response plan and customer notification SLA?
BCP/DR plan and last test date?
Log export to customer SIEM (if applicable)?

Section E: Relationship (4)

Subprocessor change notification period?
Annual security review or audit evidence sharing?
Security contact and response SLA?
Certification roadmap for the next 12 months?

Receiving one of these?

If you're the one answering: paste this list into Rampwire, upload your policies once, and get a grounded draft for every row, with citations and confidence flags on the ones needing a human decision.

How many questions should a right-sized questionnaire have?

For most SaaS-to-SaaS relationships, 30 to 60 well-chosen questions cover the meaningful risk. Beyond that, response quality drops and vendors start copy-pasting, which defeats the purpose of asking.

Can I automate filling this template in?

Yes. Upload your security documentation once and a retrieval-based tool like Rampwire drafts every answer with source citations, so each response traces back to your actual policies.

Tired of answering these by hand?

Rampwire drafts grounded answers from your own policies, with citations and confidence flags.

Start free