Vendor Security Questionnaire Template and Vendor Risk Register

Small businesses are told to vet their vendors and then handed either a 300-question enterprise form or nothing. This guide is the middle path: which vendors need review, what to ask them, what evidence to request, how to record the gaps you decide to live with, who approves and how often to look again. It extends our article on vendor risk management for small business with the working documents.

Downloads (original NetSys templates, no registration):

• Download the vendor security questionnaire (Excel, .xlsx): 44 plain-language questions in seven sections (company, security program, access control, data handling, incident response, business continuity, compliance), each tagged with the vendor tier it applies to, plus answer, evidence and reviewer columns and an evidence checklist.
• Download the vendor risk register (Excel, .xlsx): one row per vendor with data access, system access, criticality tier, questionnaire status, findings, exceptions, approver and the next review date, with a tiering guide and an exceptions log.

Both files are NetSys originals written for a business of roughly 5 to 200 people. They are not copies of any commercial questionnaire.

Which vendors need a security review?

Vendor risk is the exposure a business takes on when an outside company holds its data, connects to its systems or runs a process it cannot do without. Not every supplier carries it. Tier vendors by two questions, what data they touch and what access they have, plus one flag, whether the business stops without them.

The register suggests a tier from the data and access answers and lets you override it with a reason. Most small businesses find five to ten Tier 1 vendors, which is a manageable number to review properly.

What should a vendor security questionnaire ask?

Ask questions a vendor without a compliance department can still answer honestly, and that you can judge. The template's seven sections cover:

1. Company. Legal entity, security contact, cyber insurance, subprocessors and their locations, and incidents in the last 36 months.
2. Security program. Written policy, independent attestation, penetration testing cadence, staff training, vulnerability management timeframes, endpoint protection, background checks.
3. Access control. Multifactor authentication on everything that reaches customer data, least privilege and access reviews, speed of removal when staff leave, how their access to your systems is requested and logged, single sign-on support.
4. Data handling. Which categories of your data they receive, where it is stored, encryption in transit and at rest, separation from other customers, retention and deletion, export, and whether your data trains AI models.
5. Incident response. A tested plan, hours to notify you, what the notification contains, monitoring, cooperation with your investigation.
6. Business continuity. Tested recovery plan, recovery time and recovery point objectives, backups protected against deletion, availability history, and what happens to your data if the vendor closes.
7. Compliance. Which laws and standards apply to the service, evidence you may review, contract terms (security commitments, breach notification, audit or evidence rights, termination for security failure), and anything they cannot answer today.

Each question carries a tier tag, so a Tier 3 vendor gets a short set and a Tier 1 vendor gets everything. Answers are Yes, Partial, No or N/A, and a named reviewer marks each one Accept, Follow up or Finding.

What evidence should you request, and how do you read it?

Answers are claims. Evidence is what makes a claim checkable, and the amount you ask for should follow the tier.

Larger programs often use published question sets, for example the Cloud Security Alliance's Consensus Assessment Initiative Questionnaire, which is built into its Cloud Controls Matrix (CSA Cloud Controls Matrix and CAIQ, version 4.1 combined, checked on November 7, 2026). If a vendor already publishes answers to one of those, accept them in place of yours and read them against the same evidence list.

Screening is not certification

Screening is your judgment that a vendor's answers and evidence are adequate for the risk it carries. Certification is a third party's formal statement that the vendor met a defined standard. A completed questionnaire, even a perfect one, is screening. It does not make the vendor compliant with anything, it does not transfer your own duties to protect data, and it is not an audit. Keep the two words apart in your records and in what you tell customers.

How do you record exceptions?

An exception is a gap you know about and decide to accept for now. Most Tier 1 reviews produce at least one: a vendor without a recent penetration test, a missing breach notification clause, a subprocessor in a region you did not expect. Record each exception with five things: what is missing, why you accepted it, the compensating control, who approved it and when it expires. The register's exceptions log holds these and highlights any that have passed their date. An exception without an expiry becomes permanent by accident.

Who approves the decision?

The reviewer and the approver should be different people. The reviewer, often your IT lead or a virtual CISO, reads the answers and evidence and writes the findings. The approver is the person with authority to accept risk for the business: the owner, managing partner or practice administrator. Record the decision as Approved, Approved with exceptions or Declined, with the date. When a Tier 1 vendor is approved with exceptions, the approver should sign the exception lines too.

How often should vendors be reviewed?

Tier 1 every 12 months, Tier 2 every 24 months, Tier 3 at renewal or when what the vendor does for you changes. Review sooner after a vendor incident, a change of ownership, a new integration or a change in the data you share. The register calculates the next review date from the last review and the cadence, and the summary sheet counts overdue reviews and expired exceptions so the list stays honest. Offboarding matters as much as onboarding: when a vendor leaves, remove its access, confirm deletion of your data and close the row.

How this fits with a general IT risk assessment

The vendor register is specific to third parties. Your own systems, people and processes belong in a general register, where one line per important vendor is enough. Our IT risk assessment template covers that broader view, and the two files reference each other.

Frequently asked questions

What is a vendor security questionnaire?

It is a structured set of questions a buyer sends to a supplier about how the supplier protects data and systems, usually with columns for the answer and the evidence behind it. It is one part of vendor due diligence, alongside the contract review and the independent evidence the vendor supplies.

What is the difference between a vendor risk assessment and a security questionnaire?

The questionnaire gathers the vendor's answers. The risk assessment is your judgment about them: the tier, the findings, the exceptions you accept and the decision. The register in this download records the assessment; the questionnaire is its input.

Can a small business use this as a third party risk assessment template?

Yes. Third party risk and vendor risk are used interchangeably for most small businesses; the register covers any outside organization that touches your data or systems, including your IT provider, your accountant's software and your cloud services. The tiering guide keeps the work proportionate.

Should our IT provider complete the questionnaire too?

Yes, as a Tier 1 vendor. An IT provider usually holds administrator rights to everything, which makes it the highest-impact vendor most small businesses have. NetSys answers the same questions for its own clients, and a provider that declines to answer has told you something.

Is a vendor with a SOC 2 report automatically approved?

No. Read the report: the period, the systems in scope and the exceptions. A current Type 2 report with a clean opinion is strong evidence for the controls it covers, but it may not cover the product you buy, and it says nothing about your contract terms or how the vendor would notify you of a breach.

What do we do when a vendor refuses to answer?

Decide by tier. A Tier 3 vendor can be approved on contract terms alone. A Tier 1 vendor that will not answer or provide evidence should be recorded as Declined or approved with a dated exception and a plan to replace it. The refusal itself is a finding.

Get help with your vendor list

If you want a second pair of eyes on your Tier 1 vendors, or someone to run the review and present the exceptions for approval, our virtual CISO service does this as part of a security program. Book a call and bring your vendor list.

Sources and further reading

• Cloud Security Alliance, Cloud Controls Matrix and Consensus Assessment Initiative Questionnaire: a published control framework and vendor questionnaire for cloud services, version 4.1. Checked on November 7, 2026.
• NIST Cybersecurity Framework 2.0: supply chain risk management sits under the Govern function. Checked on November 7, 2026.