Supplier security questionnaire: template and key questions

A supplier security questionnaire is used to assess a provider's cybersecurity level before entrusting it with your data or access to your information system, and then throughout the contract. To be useful, it must be proportionate to the supplier's criticality, require evidence for every important answer and lead to a decision. This guide, which builds on our article on third-party risk management (TPRM), gives you the method and a downloadable 30-question template.

The questionnaire is the basic tool of supplier cybersecurity assessment. It comes in at three points: during selection (to compare offers and rule out a candidate that is too weak), before signing (to know which requirements to put in the contract) and during the relationship (to check the level is maintained). It replaces neither risk analysis nor audit, but it shows where to focus them.

It also meets an obligation. NIS 2 requires taking into account each direct supplier's vulnerabilities and cybersecurity practices, DORA requires due diligence before any ICT services contract, and the GDPR requires working only with processors that provide sufficient guarantees: we detail these texts in our article on third-party risk, NIS 2 and DORA. The stakes are real: according to Verizon's 2025 DBIR, a third party is involved in 30% of the breaches studied.

Questionnaire, audit, external rating: three complementary tools

The questionnaire collects the supplier's own account of its practices; it covers many topics at low cost. An audit, on documents or on site, checks those practices in depth, but is expensive and best kept for critical third parties. External rating services observe what the supplier exposes on the internet (certificates, open ports, known leaks): useful for spotting a weak signal, they say nothing about its internal organisation. A mature approach combines all three according to criticality, and the questionnaire remains the entry point.

Sending 200 questions to an office supplies vendor and 20 to your managed service provider is the most common mistake. Start by ranking your third parties on four criteria, then derive a level:

Three levels are enough for most organisations: standard (around ten questions, reviewed at renewal), important (about twenty-five questions with evidence) and critical (full questionnaire, systematic evidence, audit rights). The template below applies this logic: choose a level to see the questionnaire shrink or grow.

Governance

Does the supplier have a security policy approved by its management, a named owner, a risk assessment covering the service? These questions tell you whether security is managed or endured.

Access management

This is the family that best predicts incidents: multi-factor authentication, named privileged accounts, access reviews, leavers handled promptly, administrative access through a controlled point. ANSSI's outsourcing guide stresses this for remote interventions.

Encryption and data protection

Encryption in transit and at rest, including backups, separation between customers, and above all: who holds the keys? For sensitive data, customer control of the keys significantly changes the risk level.

Operations and vulnerabilities

Patch deadlines, regular penetration tests, centralised and monitored logs: these are the signs of well-run operations.

Backups and continuity

An untested backup is only an assumption. Ask for an isolated copy, a recent restoration test and, for a critical service, recovery objectives (RTO, RPO) consistent with your own business continuity plan.

Incident management

An existing procedure, a notification time stated in hours, a history of recent incidents and the measures taken. The notification time must be compatible with your own reporting obligations.

Fourth parties

Your supplier has suppliers of its own: hosting provider, offshore support, software vendors. Ask for the list, the countries, the requirements it imposes on them and a commitment to inform you of any change. Supply chain attacks often go through this tier that nobody looks at.

Location and hosting

Countries of hosting, backup and access (support counts too), exposure to non-European laws, conditions for returning and deleting data at the end of the contract.

Certifications and qualifications

• ISO/IEC 27001:2022: certification of the information security management system; everything depends on its scope.
• HDS: mandatory to host health data in France; the framework published in the Official Journal on 16 May 2024 requires hosting within the European Economic Area and gave already-certified hosts until 16 May 2026 to migrate (see our article on HDS certification).
• SecNumCloud: ANSSI's qualification for cloud services, which includes requirements for protection against non-European laws (see our SecNumCloud article).
• SOC 2: a US attestation report; Type II covers the operating effectiveness of controls over a period, Type I only their design at a point in time.

Here is our template: 30 questions in nine families, each with the expected evidence and the criticality from which to ask it. It contains 11 questions for a standard supplier, 25 for an important supplier and 30 for a critical supplier.

Download the questionnaire template (CSV, 30 questions) UTF-8 CSV file, semicolon-separated: family, question, expected evidence, minimum criticality. It opens in Excel, LibreOffice or Google Sheets.

No need to start from scratch, nor to take everything: draw on recognised frameworks, then cut down.

• ANSSI's guide on outsourcing and information system security (2010) provides, in its annexes, standard security requirements (antivirus, patching, backups, authentication, filtering, traceability, physical security, staff qualifications) and contract clauses. It remains the French reference for managed services.
• The Cloud Security Alliance's CAIQ (Consensus Assessment Initiative Questionnaire), aligned with the Cloud Controls Matrix: 261 questions in version 4.0, 283 in version 4.1 released in January 2026. Many cloud providers publish a completed one: ask for it before sending yours.
• Shared Assessments' SIG (Standardized Information Gathering), updated every year, available in Lite and Core versions, widely used in English-speaking financial sectors.
• Controls 5.19 to 5.23 in Annex A of ISO/IEC 27001:2022, on supplier relationships and cloud services, and the ISO/IEC 27036 series to go further.

These standard questionnaires are exhaustive by design: they are catalogues, not questionnaires to send as is. The right reflex is to accept a CAIQ or SIG already completed by the supplier, then only ask the questions specific to your context.

A “yes” is only worth something if it can be checked. A few simple checks avoid most bad surprises:

For a critical supplier, add an interview with its security lead, or even a document or on-site audit if the contract allows: setting these commitments and oversight rights is precisely the role of the security assurance plan.

A simple scale is enough: two points for a requirement met and evidenced, one point for a partial or unevidenced answer, zero for non-compliance, with non-applicable questions excluded. The score shows a trend; the decision depends on the gaps themselves. A single non-compliance on a managed service provider's multi-factor authentication can justify rejection, whatever the overall score.

The example below shows why verification changes everything: the same supplier goes from “acceptable” to “action plan required” once the evidence is examined.

Four outcomes are possible:

• accept the supplier as it is;
• accept with conditions, with a dated action plan written into the contract;
• formally accept the residual risk, by the risk owner, when the service is indispensable;
• reject or look for an alternative.

A questionnaire sent without a deadline rarely comes back. Set a return date (two to three weeks for a full questionnaire), send a reminder halfway, then escalate to the account manager or buyer. Tell the supplier from the start which evidence you expect: that is what takes the longest.

Assessment is not a snapshot. Reassess at a pace set by criticality, and whenever an event justifies it: incident at the supplier, change of subcontractor or hosting, acquisition, extension of the service scope. Starting from the previous assessment rather than from scratch saves both parties time and shows progress.