Your Security Is Only as Strong as Your Weakest Vendor
A growing share of major data breaches don't start inside the victim organization at all — they start at a third-party vendor with access to systems or data, and weaker security controls than the company that hired them. Vendor risk assessment is often treated as a box-checking exercise buried in procurement paperwork, but a focused, specific questionnaire, reviewed by someone who understands the answers, is one of the most effective controls a business can put in place before granting a vendor access to anything sensitive.
Six Categories That Actually Matter
A useful vendor security questionnaire doesn't need hundreds of questions — it needs the right ones, organized so a reviewer can quickly spot gaps. Six categories consistently surface the risks that matter most:
- Data Handling — what data will the vendor actually touch, is it classified and handled according to a documented policy, and will it flow to any subcontractors you haven't directly vetted?
- Access Control — does the vendor enforce least privilege, require MFA, and promptly revoke access for departed staff? This is where a huge share of real-world vendor breaches originate.
- Encryption — is your data encrypted at rest and in transit with a real named standard (e.g. AES-256, TLS 1.2+), and how are the keys themselves managed?
- Incident History — has the vendor had a breach in the last few years, do they have a documented incident response plan, and what's their SLA for telling you if something happens to your data?
- Compliance & Certifications — SOC 2 Type II, ISO 27001, PCI-DSS, or HITRUST are strong (though not perfect) proxies for a baseline security program, and a vendor should be able to produce a recent attestation on request.
- Business Continuity — what are their actual Recovery Time and Recovery Point Objectives, and when was their disaster recovery plan last tested (not just written)?
Reading the Answers, Not Just Collecting Them
A completed questionnaire is only useful if someone actually evaluates the answers critically. A simple scoring approach — Yes = 2, Partial = 1, No = 0 per question — turns a stack of prose answers into a comparable number you can track across vendors and over time. It's not a substitute for judgment (a single "No" on encryption key management can outweigh a dozen "Yes" answers elsewhere), but it gives you a consistent starting point and makes it easy to flag vendors who score low relative to the sensitivity of what they'll access.
Red Flags in Vendor Responses
- Vague or evasive answers to specific questions (e.g. "we take security seriously" instead of naming an actual encryption standard).
- No documented incident response plan — a vendor without one has never seriously thought through what happens when something goes wrong.
- Unwillingness to share a recent audit report or certification when one is claimed to exist.
- No clear answer on subcontractors — your data's actual risk exposure includes every fourth party it touches, not just the vendor you signed a contract with.
- Untested disaster recovery plans — a DR plan that has never been tested is a plan that has never actually been proven to work.
Make It Part of Onboarding, Not an Afterthought
The highest-leverage moment to run this questionnaire is before a vendor gets access to anything — not after a contract is already signed and integration work has begun, when leverage to demand changes is much lower. Building the habit of sending a focused questionnaire, scoring the responses, and following up on weak answers before onboarding any new vendor with access to sensitive data closes one of the most common gaps in an otherwise solid security program.