Checklist
Security questionnaire checklist for IT suppliers
The questions public buyers usually ask in vendor security questionnaires, and a checklist of documents and answers to prepare so you can respond in hours rather than weeks.
Before buying software or services, many public bodies send suppliers a security questionnaire, sometimes hundreds of questions long. Firms that answer quickly and clearly look more trustworthy, and often get through procurement faster.
Keep these documents ready
- Security certifications: ISO 27001 certificate, SOC 2 report, Cyber Essentials, IRAP report or FedRAMP status.
- Information security policy.
- Acceptable use policy.
- Access control policy.
- Incident response plan.
- Business continuity and disaster recovery plans, with test dates.
- Data retention and deletion policy.
- Privacy policy and data processing agreement template.
- Penetration test summary from the last 12 months.
- List of subprocessors and their locations.
- Architecture or data flow diagram.
- Insurance certificates, including cyber.
- Accessibility conformance report, for software.
Questions you'll be asked
Governance
- Who is responsible for security?
- How often are policies reviewed?
- Do staff get security training, and how often?
People
- Are staff background checked? See security screening in Canada.
- Do staff sign confidentiality agreements?
- How is access removed when people leave?
Access
- Is multi-factor authentication enforced for all staff and admin access?
- Is single sign-on available for customers?
- How are privileged accounts managed and reviewed?
Data
- Where is data stored, including backups? See data residency.
- Is data encrypted in transit and at rest? With what?
- Who manages encryption keys?
- How is customer data separated from other customers'?
Operations
- How are vulnerabilities found and patched, and how quickly?
- Is there logging and monitoring, and how long are logs kept?
- How often are backups taken and restores tested?
- When was the last penetration test, and were findings fixed?
Incidents
- How quickly will you notify us of a security incident?
- Have you had a breach in the last three years?
Supply chain
- Which subprocessors and third-party services do you use?
- How do you assess their security?
- Do you keep a software bill of materials?
Tips
- Answer honestly. "Not yet, planned for Q2" is better than a claim you can't back up.
- Keep one master set of answers and update it every quarter.
- Point to evidence rather than writing essays.
- Standard formats like the Cloud Security Alliance's CAIQ can be reused across buyers.
Common questions
How long does it take to complete a security questionnaire?
With a prepared library of answers, a few hours to a day. From scratch, it can take weeks.
Can I send our SOC 2 or ISO certificate instead of answering?
Some buyers accept certifications in place of some questions, but most still want the questionnaire completed. Reference your evidence in the answers.
What if we don't meet a requirement in the questionnaire?
Say so, explain any compensating controls, and give a date for fixing it. Buyers often accept a plan for minor gaps.