A comprehensive vendor security questionnaire for critical (Tier 1) vendors: those with access to sensitive data or systems whose failure would significantly disrupt operations. 116 questions across 20 control domains, each mapped to SOC 2 and ISO 27001:2022 Annex A (AI section mapped to ISO 42001 / NIST AI RMF).
For an industry-standard alternative, CAIQ (cloud), VSA-Full, or SIG Core cover similar ground.
How to use
- Confirm the tier. Send this Full version to vendors that store, process, or transmit sensitive data, integrate with production systems, or whose outage would materially disrupt your operations.
- Send it to the vendor. Allow two to three weeks; this is a real effort for the vendor.
1. Company & Service Overview
| # | Question | Maps to |
|---|
| 1 | What is your legal entity name, ownership structure, and primary place of business? | SOC 2 CC1.1; ISO A.5.1 |
| 2 | What is the hosting model, and where are the service and its data hosted (cloud provider and region/data residency)? | SOC 2 CC1; ISO A.5.23 |
| 3 | What categories of customer data will the service store, process, or transmit (e.g., PII, PHI, financial, credentials)? | SOC 2 CC3.2; ISO A.5.12 |
| 4 | Do you use subcontractors or sub-processors to deliver the service? List those with access to customer data. | SOC 2 CC9.2; ISO A.5.19 |
| 5 | Are there any material legal, regulatory, or security claims currently against the company? | SOC 2 CC1.1; ISO A.5.31 |
2. Governance, Risk & Security Policy
| # | Question | Maps to |
|---|
| 6 | Do you maintain a documented information security policy approved by leadership and reviewed at least annually? | SOC 2 CC1.1, CC5.3; ISO A.5.1 |
| 7 | Is there a named individual or team accountable for information security (e.g., CISO, security lead)? | SOC 2 CC1.3; ISO A.5.2 |
| 8 | Do you operate a formal risk management process that identifies, assesses, and treats security risks? | SOC 2 CC3.1-CC3.4; ISO Clause 6, A.5.1 |
| 9 | Do you maintain an inventory of information assets and systems that handle customer data? | SOC 2 CC3.2; ISO A.5.9 |
| 10 | Is there a documented acceptable use policy for company systems and data? | SOC 2 CC1.1; ISO A.5.10 |
| 11 | Do you carry cyber liability insurance? State coverage scope if so. | SOC 2 CC9.1; ISO A.5.29 |
| 12 | Do you undergo an independent review or audit of your security program? State type and cadence. | SOC 2 CC4.1; ISO A.5.35 |
3. Human Resources Security
| # | Question | Maps to |
|---|
| 13 | Are background checks performed on personnel prior to granting access to customer data? | SOC 2 CC1.4; ISO A.6.1 |
| 14 | Are employees and contractors required to sign confidentiality / non-disclosure agreements? | SOC 2 CC1.1; ISO A.6.6 |
| 15 | Is security awareness training delivered at onboarding and at least annually thereafter? | SOC 2 CC1.4; ISO A.6.3 |
| 16 | Is role-specific security training provided to engineers and privileged users? | SOC 2 CC1.4; ISO A.6.3 |
| 17 | Is there a documented disciplinary process for security policy violations and a defined offboarding process? | SOC 2 CC1.5; ISO A.6.4, A.6.5 |
4. Access Control & Identity
| # | Question | Maps to |
|---|
| 18 | Is multi-factor authentication (MFA) enforced for all administrative, remote, and customer-data access? | SOC 2 CC6.1; ISO A.8.5 |
| 19 | Do you apply role-based access control (RBAC) on a least-privilege basis? | SOC 2 CC6.1, CC6.3; ISO A.8.3, A.5.15 |
| 20 | Are user access rights reviewed at least quarterly and recertified by owners? | SOC 2 CC6.3; ISO A.5.18 |
| 21 | Is privileged/administrative access restricted, logged, and separately controlled (e.g., PAM)? | SOC 2 CC6.1; ISO A.8.2 |
| 22 | Is access revoked within a defined SLA when personnel are terminated or change roles? State the SLA. | SOC 2 CC6.2, CC6.3; ISO A.5.18 |
| 23 | Do you enforce a strong password/credential policy (length, complexity, rotation on compromise)? | SOC 2 CC6.1; ISO A.5.17 |
| 24 | Is single sign-on (SSO) supported, and is SCIM or equivalent available for provisioning? | SOC 2 CC6.1; ISO A.5.16 |
| 25 | Are service accounts, API keys, and secrets centrally managed and rotated? | SOC 2 CC6.1; ISO A.8.5, A.5.17 |
| 26 | Is session management enforced (timeouts, re-authentication for sensitive actions)? | SOC 2 CC6.1; ISO A.8.5 |
5. Encryption & Key Management
| # | Question | Maps to |
|---|
| 27 | Is customer data encrypted in transit using TLS 1.2 or higher? | SOC 2 CC6.7; ISO A.8.24 |
| 28 | Is customer data encrypted at rest using a strong standard (e.g., AES-256)? | SOC 2 CC6.1; ISO A.8.24 |
| 29 | How are encryption keys generated, stored, rotated, and access-controlled (e.g., KMS/HSM)? | SOC 2 CC6.1; ISO A.8.24 |
| 30 | Is there separation of duties for key management (no single person controls keys end to end)? | SOC 2 CC6.1; ISO A.8.24 |
| 31 | Do you support customer-managed keys (CMK/BYOK) where required? | SOC 2 CC6.1; ISO A.8.24 |
| 32 | Are cryptographic standards reviewed against current guidance and deprecated algorithms removed? | SOC 2 CC6.7; ISO A.8.24 |
6. Data Handling, Retention & Classification
| # | Question | Maps to |
|---|
| 33 | Do you maintain a data classification scheme and handle data according to its classification? | SOC 2 CC3.2; ISO A.5.12 |
| 34 | Do you maintain a current list of sub-processors with access to customer data and notify customers of changes? | SOC 2 CC9.2; ISO A.5.19, A.5.20 |
| 35 | What are your data retention periods and secure deletion practices, including on contract termination? | SOC 2 C1.2; ISO A.8.10 |
| 36 | Is production customer data prevented from being used in non-production environments, or is it masked/anonymized? | SOC 2 CC6.1; ISO A.8.11, A.8.31 |
| 37 | Are data loss prevention (DLP) or egress controls in place for sensitive data? | SOC 2 CC6.7; ISO A.8.12 |
| 38 | Is data segregated by tenant (logical or physical) in multi-tenant environments? | SOC 2 CC6.1; ISO A.8.22 |
7. Privacy & Data Protection
| # | Question | Maps to |
|---|
| 39 | Do you have a documented and published privacy policy? | SOC 2 P1; ISO A.5.34 |
| 40 | Do you comply with applicable data protection laws (e.g., GDPR, CCPA/CPRA) for the personal data you process? | SOC 2 P1-P8; ISO A.5.31, A.5.34 |
| 41 | Will you sign a Data Processing Agreement (DPA) and act as processor under our instructions? | SOC 2 P4; ISO A.5.20, A.5.34 |
| 42 | Do you support data subject rights requests (access, deletion, portability) within statutory timelines? | SOC 2 P5, P6; ISO A.5.34 |
| 43 | For international transfers, what mechanism do you rely on (e.g., SCCs, adequacy, DPF)? | SOC 2 P4; ISO A.5.34 |
| 44 | Do you process special-category data (PHI, children’s data, biometric, financial)? If so, which and under what controls? | SOC 2 P4; ISO A.5.34 |
| 45 | Do you maintain records of processing activities (ROPA) and conduct DPIAs where required? | SOC 2 P2; ISO A.5.34 |
8. Network & Infrastructure Security
| # | Question | Maps to |
|---|
| 46 | Are firewalls and network access controls in place between untrusted and internal networks? | SOC 2 CC6.6; ISO A.8.20 |
| 47 | Is the network segmented to isolate production, sensitive data, and management planes? | SOC 2 CC6.1; ISO A.8.22 |
| 48 | Are intrusion detection/prevention (IDS/IPS) or equivalent controls deployed? | SOC 2 CC7.1; ISO A.8.16 |
| 49 | Is remote administrative access restricted to VPN/bastion with MFA? | SOC 2 CC6.6; ISO A.6.7, A.8.20 |
| 50 | Are DDoS protections and rate limiting in place for internet-facing services? | SOC 2 A1.1; ISO A.8.6 |
| 51 | Is security of network services (DNS, email, TLS config) hardened and monitored? | SOC 2 CC6.6; ISO A.8.21 |
| 52 | Are wireless and corporate networks separated from systems handling customer data? | SOC 2 CC6.6; ISO A.8.22 |
9. Endpoint & Server Security
| # | Question | Maps to |
|---|
| 53 | Is anti-malware / EDR deployed on endpoints and servers with central management? | SOC 2 CC6.8; ISO A.8.7 |
| 54 | Are company endpoints managed (MDM), encrypted at the disk level, and screen-locked? | SOC 2 CC6.7; ISO A.8.1 |
| 55 | Are systems hardened to a defined baseline (e.g., CIS Benchmarks) and configuration-managed? | SOC 2 CC7.1; ISO A.8.9 |
| 56 | Is a documented patch management process in place with timelines for OS and software updates? | SOC 2 CC7.1; ISO A.8.8 |
| 57 | Is removable media use controlled, and is secure disposal of media/equipment performed? | SOC 2 CC6.7; ISO A.7.10, A.7.14 |
10. Application & Secure Development (SDLC)
| # | Question | Maps to |
|---|
| 58 | Do you follow a documented secure software development lifecycle (SDLC)? | SOC 2 CC8.1; ISO A.8.25 |
| 59 | Are security requirements defined and threat modeling performed for new features? | SOC 2 CC8.1; ISO A.8.26, A.8.27 |
| 60 | Is peer code review required before merging to production? | SOC 2 CC8.1; ISO A.8.28 |
| 61 | Do you run static analysis (SAST) and software composition analysis (SCA) in CI? | SOC 2 CC7.1, CC8.1; ISO A.8.28, A.8.8 |
| 62 | Do you run dynamic testing (DAST) or equivalent on running applications? | SOC 2 CC7.1; ISO A.8.29 |
| 63 | Are development, test, and production environments separated? | SOC 2 CC8.1; ISO A.8.31 |
| 64 | Are dependencies and open-source components tracked (SBOM) and monitored for vulnerabilities? | SOC 2 CC7.1; ISO A.8.8, A.5.21 |
| 65 | Do you follow secure coding standards aligned to OWASP Top 10 or similar? | SOC 2 CC8.1; ISO A.8.28 |
11. Change Management
| # | Question | Maps to |
|---|
| 66 | Is there a documented change management process with approvals before production changes? | SOC 2 CC8.1; ISO A.8.32 |
| 67 | Is automated validation/testing performed on changes before deployment? | SOC 2 CC8.1; ISO A.8.29 |
| 68 | Are rollback procedures defined for failed or risky changes? | SOC 2 CC8.1; ISO A.8.32 |
| 69 | Are customers notified of significant changes affecting security or data handling? | SOC 2 CC2.3; ISO A.8.32 |
12. Vulnerability & Threat Management
| # | Question | Maps to |
|---|
| 70 | Do you perform regular internal and external vulnerability scanning? State cadence. | SOC 2 CC7.1; ISO A.8.8 |
| 71 | Do you commission third-party penetration testing at least annually, and will you share a summary? | SOC 2 CC7.1; ISO A.8.8 |
| 72 | Are remediation SLAs defined by severity (e.g., critical, high)? State them. | SOC 2 CC7.1; ISO A.8.8 |
| 73 | Do you operate a bug bounty or coordinated vulnerability disclosure program? | SOC 2 CC7.1; ISO A.8.8 |
| 74 | Do you consume threat intelligence to prioritize emerging threats? | SOC 2 CC7.1; ISO A.5.7 |
| 75 | Are web application protections (e.g., WAF) in place for internet-facing apps? | SOC 2 CC6.6; ISO A.8.23 |
13. Logging, Monitoring & Detection
| # | Question | Maps to |
|---|
| 76 | Are security-relevant events logged across applications, infrastructure, and access? | SOC 2 CC7.2; ISO A.8.15 |
| 77 | Are logs centralized (e.g., SIEM), tamper-protected, and retained for a defined period? State retention. | SOC 2 CC7.2; ISO A.8.15 |
| 78 | Are logs actively monitored or alerted on for suspicious activity? | SOC 2 CC7.2; ISO A.8.16 |
| 79 | Is time synchronization (NTP) enforced across systems for reliable correlation? | SOC 2 CC7.2; ISO A.8.15 |
| 80 | Are administrative and privileged actions logged and reviewed? | SOC 2 CC7.2; ISO A.8.15, A.8.2 |
14. Incident Response
| # | Question | Maps to |
|---|
| 81 | Do you maintain a documented incident response plan with defined roles? | SOC 2 CC7.3, CC7.4; ISO A.5.24 |
| 82 | How often is the IR plan reviewed and tested (e.g., tabletop exercises)? | SOC 2 CC7.4; ISO A.5.24 |
| 83 | What is your customer breach-notification commitment (timeframe and method)? | SOC 2 CC7.4; ISO A.5.26 |
| 84 | Is there a defined process for triage, containment, eradication, and recovery? | SOC 2 CC7.4, CC7.5; ISO A.5.26 |
| 85 | Do you perform post-incident reviews and track corrective actions? | SOC 2 CC7.5; ISO A.5.27 |
| 86 | Are forensic evidence-handling procedures defined for significant incidents? | SOC 2 CC7.4; ISO A.5.28 |
15. Business Continuity & Disaster Recovery
| # | Question | Maps to |
|---|
| 87 | Are backups performed regularly, encrypted, and stored separately? State frequency and retention. | SOC 2 A1.2; ISO A.8.13 |
| 88 | Are backup restorations tested on a defined schedule? State cadence. | SOC 2 A1.3; ISO A.8.13 |
| 89 | Do you have documented RTO and RPO targets for the service? State them. | SOC 2 A1.2, A1.3; ISO A.5.30 |
| 90 | Do you maintain a business continuity / disaster recovery plan that is tested at least annually? | SOC 2 A1.2; ISO A.5.29, A.5.30 |
| 91 | Is the service deployed across multiple availability zones/regions for resilience? | SOC 2 A1.1; ISO A.5.30 |
16. Physical & Environmental Security
| # | Question | Maps to |
|---|
| 92 | Are facilities (offices, data centers) protected by physical access controls? | SOC 2 CC6.4; ISO A.7.1, A.7.2 |
| 93 | If you rely on cloud data centers, do they hold relevant certifications (e.g., SOC 2, ISO 27001)? | SOC 2 CC6.4; ISO A.5.23 |
| 94 | Is physical access logged and monitored (badging, CCTV)? | SOC 2 CC6.4; ISO A.7.4 |
| 95 | Are environmental controls (power, fire, cooling) in place at facilities you operate? | SOC 2 A1.1; ISO A.7.8 |
17. Cloud & Hosting Security
| # | Question | Maps to |
|---|
| 96 | Is cloud configuration managed against a secure baseline and monitored for drift (CSPM)? | SOC 2 CC7.1; ISO A.5.23, A.8.9 |
| 97 | Is infrastructure provisioned as code with peer review and version control? | SOC 2 CC8.1; ISO A.8.9 |
| 98 | Are cloud storage buckets/databases private by default and audited for public exposure? | SOC 2 CC6.1; ISO A.5.23 |
| 99 | Is the shared-responsibility model documented for your cloud services? | SOC 2 CC1.2; ISO A.5.23 |
| 100 | Are cloud audit logs (e.g., CloudTrail equivalent) enabled and retained? | SOC 2 CC7.2; ISO A.8.15 |
18. Supply Chain / Nth-Party Risk
| # | Question | Maps to |
|---|
| 101 | Do you assess the security of your own vendors/sub-processors before onboarding? | SOC 2 CC9.2; ISO A.5.19 |
| 102 | Are security requirements included in contracts with your suppliers? | SOC 2 CC9.2; ISO A.5.20 |
| 103 | Do you monitor and periodically reassess supplier security over time? | SOC 2 CC9.2; ISO A.5.22 |
| 104 | Do you manage risks in the ICT/software supply chain (e.g., dependency provenance, signing)? | SOC 2 CC9.2; ISO A.5.21 |
19. AI Governance (if AI/ML is used on customer data)
| # | Question | Maps to |
|---|
| 105 | Do you have an AI governance policy and a named owner for AI risk? | ISO 42001 Clause 5; NIST AI RMF Govern |
| 106 | Is customer data used to train or fine-tune models? If so, with what consent and controls? | ISO 42001 A.7; NIST AI RMF Map |
| 107 | Do you use third-party AI/LLM providers? List them and the data shared. | ISO 42001 A.10; NIST AI RMF Map |
| 108 | Are AI systems tested for accuracy, bias, and harmful output before and during use? | ISO 42001 A.6; NIST AI RMF Measure |
| 109 | Can customers opt out of AI processing or model training on their data? | ISO 42001 A.8; NIST AI RMF Manage |
| 110 | Are AI-specific risks (prompt injection, data leakage, model misuse) assessed and mitigated? | ISO 42001 A.6; NIST AI RMF Manage |
20. Compliance & Certifications
| # | Question | Maps to |
|---|
| 111 | Do you hold a current SOC 2 Type II report? Provide the report and audit period. | SOC 2 (overall); ISO A.5.35 |
| 112 | Do you hold ISO 27001 certification (and ISO 27701/42001 if applicable)? Provide the certificate. | ISO A.5.35; ISO A.5.36 |
| 113 | Are you PCI DSS compliant (if handling cardholder data)? State level. | SOC 2 CC; ISO A.5.31 |
| 114 | Are you HIPAA compliant and will you sign a BAA (if handling PHI)? | SOC 2 P4; ISO A.5.34 |
| 115 | Can you share a completed CAIQ, SIG, or equivalent on request? | SOC 2 CC9.2; ISO A.5.19 |
| 116 | Do you maintain a list of legal, regulatory, and contractual requirements applicable to the service? | SOC 2 CC2.2; ISO A.5.31 |
Sources & basis
This template was synthesized from the following published questionnaires and guidance. Framework mappings are illustrative and should be confirmed against your own SOC 2 / ISO 27001 control set before you rely on them.
