Skip to content
AuditFront
ISO 27001xlsx

Vendor Risk Assessment Questionnaire

Download a 20-question supplier security worksheet with guidance, response fields and space for evidence and reviewer notes.

Updated

No account required · Autosaves in this browser for 30 days · Sign up only to keep it

What's Inside

20 supplier security questions across six topics
Guidance beside each question
Vendor response column
Manual score field from 1 to 5
Evidence-provided column
Assessor notes for findings and follow-up

About This Template

The file is a single Vendor Assessment worksheet. Its 20 questions cover governance, access, data protection, continuity, compliance and sub-processors. Use it for an initial review, then add questions that reflect the access and data you will give the supplier. A payroll provider and a public website host need different follow-up.

Send the relevant questions to the supplier with a clear description of the service under review. Ask for evidence that matches that service: certificate scope, the relevant assurance report, a recovery-test summary or contractual terms. A company-wide security statement may not cover the product, region or sub-processor you will actually use.

The score field is for your judgement; the file does not calculate an overall vendor risk rating. Define your acceptance criteria before scoring and record unresolved issues in the notes. If a supplier cannot provide an artifact, ask what alternative evidence they can share. Keep commercial approval and acceptance of a security exception as explicit decisions.

The download is available without an account or email address. Keep a working copy, record who completed the review and retain the evidence used to reach each decision. The online assessment is a separate way to organise your review; downloading this file does not create an assessment in the app.

Who It's For

Security and compliance teams responsible for vendor risk management programsProcurement managers who need to evaluate vendor security as part of the onboarding processCISOs building or maturing their organization's third-party risk management programCTOs at startups who need to demonstrate vendor assessment practices for ISO 27001 or customer requirementsData Protection Officers evaluating data processors under GDPR Article 28 requirements

How It Works

1

Open the assessment

Open the ISO 27001 assessment in AuditFront. No account is required.

2

Answer and see gaps

Work through each question and see your score, findings, and priorities.

3

Save your work

Your work autosaves for 30 days. Create a free account only to keep it or use another device.

Frequently Asked Questions

Does the worksheet calculate a vendor risk rating?
No. The 1 to 5 score field is manual. Set acceptance criteria for the service, record your reasoning and track exceptions separately.
Should I send every question to every supplier?
Use the questions relevant to the service and its access to your systems or data. Add specific follow-up for critical dependencies and sub-processors.
What if a supplier cannot share its evidence?
Ask whether a scoped report, redacted record or supervised review would address the question. Record what you could verify and who accepts any remaining uncertainty.

Ready to see where you stand?

Work through the ISO 27001 assessment, record supporting evidence and review the gaps in your answers.

Start free ISO 27001 assessment

No account required · Autosaves for 30 days · No credit card