Security questionnaire
Also called vendor security questionnaire, information security questionnaire
A security questionnaire is a standard set of questions a firm sends to a supplier to assess its information security controls. It covers areas such as access control, encryption, incident response, data location and certifications. The answers, backed by evidence, feed the supplier risk assessment and the security terms written into the contract.
How it works
The third-party risk team sends the questionnaire during onboarding and at each reassessment. The length depends on the supplier's tier, from a short screening set for low-risk vendors to several hundred questions for critical cloud or data processors. Suppliers attach evidence such as ISO 27001 certificates, SOC 2 reports and penetration test summaries. Security analysts review gaps and agree remediation actions with dates.
Questionnaires give firms a consistent, auditable record of what a supplier claims about its controls. Regulators expect firms to assess the information security of ICT providers before contracting and throughout the relationship. Answers are self-reported, so firms test them against certifications, audit reports and outside-in monitoring. Large suppliers answer many questionnaires a year and rely on industry-standard formats.
The rules
Requires firms to assess ICT providers' security before contracting and to ensure providers meet appropriate information security standards.
EU financial entitiesIncludes controls on information security in supplier relationships and in supplier agreements, which questionnaires are commonly used to evidence.
Organisations certifying an information security management systemLists information security among the areas banks review in due diligence and ongoing monitoring of third parties.
US banking organisationsCommon questions
Is a completed security questionnaire enough evidence?
Generally not on its own. Answers are self-assessed, so firms check them against independent evidence such as ISO 27001 certification, SOC 2 reports, penetration test results and, for critical suppliers, their own audits.
How long is a typical security questionnaire?
Length varies by risk. Low-risk suppliers may answer a few dozen questions, while critical providers handling sensitive data or hosting core systems can face several hundred, often based on an industry-standard template.
How often are security questionnaires repeated?
Most firms repeat them at each periodic reassessment, typically annually for critical suppliers. Incidents, new services or changes in data processing usually trigger an earlier update.
Can a firm accept a SOC 2 report instead of a questionnaire?
Many firms accept a current SOC 2 Type II report or ISO 27001 certificate in place of some questions. They still check scope, exceptions noted by the auditor and areas the report does not cover.
Our coverage
News and analysis on third-party risk from RegTech Post.
Read the coverage →RegTech PostThe Compliance Officer’s Toolkit: Building Cybersecurity into Corporate GovernanceRead the article →RegTech PostTop 5 Third Party Risk Management Software Platforms in 2025Read the article →
