Vendor Assessment Questionnaire Template: 48 Questions

A usable vendor assessment questionnaire template combines scoped questions with response, evidence, and internal decision fields—not just a list of security prompts. Copy the 48 core questions below into Excel, Word, or a form builder, then send only the modules that fit the vendor’s service. Four optional packs add up to 12 questions for AI features, privileged integrations, distributed software, and personnel access.

A vendor’s “Yes” is a claim. The assessment begins when a reviewer checks its scope, supporting evidence, owner, date, and exceptions.

This original template is an operational starting point rather than a licensed standard. It does not determine regulatory applicability, compliance, certification, or contractual position. Verify those questions against current official material and qualified counsel where appropriate.

The template produces two records, not one

A questionnaire collects vendor-supplied information. An assessment records what your organization concluded from that information. Keeping those records separate prevents vendor edits from changing internal analysis.

A TPRM checklist can therefore contain tasks such as classification, questionnaire selection, evidence review, decision recording, monitoring triggers, and offboarding. It is broader than the questionnaire itself.

For a SaaS-focused explanation of the parties, evidence, and exceptions involved, see Vendor Security Questionnaires: A Practical SaaS Guide.

A four-sheet workbook keeps claims and decisions apart

A practical Excel version uses four sheets:

1. Intake and routing: vendor, service, business owner, intended use, data flow, access model, routing score, and selected modules.
2. Questionnaire: the vendor-facing questions, response fields, explanations, and evidence IDs.
3. Evidence register: artifact metadata and the questions each artifact supports.
4. Review log: reviewer status, follow-up, gaps, accepted limitations, decision, and review triggers.

Use stable question IDs so references survive sorting and export. A useful questionnaire row contains these columns:

Keep planned separate from yes. A future target date describes intent, not the current operating state. Likewise, “not applicable” becomes reviewable only when the explanation identifies the excluded component or use case.

An eight-field evidence register can use: evidence ID, artifact title, owner, version or date, covered system, linked question IDs, controlled location, and review trigger. That is enough metadata to detect a common failure: a valid document attached to the wrong product or environment.

Copy-ready vendor assessment questionnaire template

The questions below are original operational prompts. They do not reproduce CAIQ, HECVAT, SIG, ISO, or customer-owned questionnaire text. Evidence suggestions are examples; relevance depends on the assessed service and the access available to each party.

Q01–Q12 establish scope before technical review

Scope answers are not administrative filler. Q02, Q05, and Q17 define which later evidence is relevant. If a vendor answers for its corporate environment while the buyer is assessing one hosted product, apparent contradictions will follow.

Q13–Q32 examine access, technology, development, and monitoring

Avoid combining multiple controls into an unexplained yes/no cell. Q19, for example, asks about data state and key responsibility because “encrypted” alone does not reveal which component is covered or who controls the keys.

Q33–Q48 cover incidents, resilience, fourth parties, assurance, and exit

This core set centers information security and operational resilience for technology vendors. Broader procurement reviews can attach organization-approved modules for product quality, commercial viability, sustainability, or other concerns without mixing those decisions into the security score.

Four conditional packs expand 48 questions to 60

Conditional packs keep specialized questions away from vendors that cannot answer them meaningfully. Add a pack only when the feature or access exists in the proposed use case.

All four packs produce a 60-question maximum in this model. A vendor with no AI feature, distributed component, privileged integration, or personnel access stays at 48 or fewer after applicability filtering.

Route review depth with a transparent 100-point model

The following score is an original routing device, not an external benchmark or measure of vendor quality. It estimates how deeply your intended use deserves review. Rate each factor from 0 to 4, then calculate:

Routing score = Σ (factor rating ÷ 4 × factor weight)

Intermediate ratings describe conditions between the anchors. A conservative pilot can rate an unknown factor as 4 until intake clarifies it; a team may adopt another documented unknown-handling rule.

Internal policy, contract terms, official requirements, or counsel-led analysis can override these pilot bands. No numeric result authorizes approval by itself.

Fictional worked example: A service receives an information-exposure rating of 3, access privilege of 2, operational dependency of 4, integration depth of 3, and exit friction of 1. Its calculation is 22.5 + 12.5 + 20 + 11.25 + 2.5 = 68.75. Rounded for display, 69 routes to enhanced review. The score explains review depth; it does not say that the fictional vendor is safe, unsafe, compliant, or non-compliant.

Grade evidence separately from the vendor’s answer

Do not convert response vocabulary into a risk score. “No” may describe an irrelevant control, while “Yes” may lack usable proof. Apply a separate evidence level to each material answer:

E3 is not automatically decisive. An independent report can exclude the product under review. A recent document can describe the wrong environment. Conversely, an older architecture diagram may remain usable if its owner confirms that the relevant design has not changed.

Open follow-up when one of these conditions appears:

• The answer conflicts with the cited artifact.
• “Not applicable” lacks a scope explanation.
• The artifact excludes the assessed product, region, or period.
• A planned control is described as operating today.
• A material answer has no accessible evidence or accountable owner.
• The answer omits a known exception revealed elsewhere in the questionnaire.

Reviewer labels such as accepted, clarification needed, gap recorded, and escalated describe workflow state. They do not certify a control or erase residual uncertainty.

How to conduct a vendor assessment in seven steps

1. Define the proposed use

Record the service, users, information, integrations, regions, environments, and business workflow. Assess the proposed configuration rather than the vendor’s entire company in the abstract.

2. Route before reading polished answers

Score the inherent use case using information exposure, privilege, dependency, integration, and exit friction. Doing this first keeps the vendor’s writing quality from changing the depth assigned to the use case.

3. Select questions by applicability

Choose the 16-question screen, 48-question core, or relevant add-on packs. Mark exclusions explicitly. Sending all 60 questions to every supplier creates noise without clarifying the actual decision.

Public examples illustrate the value of scope. Carnegie Mellon University’s vendor technology workbook separates SaaS-specific prompts, while the CISA Vendor SCRM Template frames its purpose around normalizing questions for ICT suppliers and providers. These references do not make a local questionnaire equivalent to either source.

4. Issue response instructions

Define the response vocabulary, evidence-ID convention, controlled sharing route, assessment scope, and clarification contact. Ask for explanations that identify product, environment, geography, and exclusions instead of generic corporate statements.

5. Validate claims against evidence

Check artifact scope, date, owner, accessibility, and consistency. Record missing proof without inventing a positive or negative answer. If several questions cite one document, confirm that the relevant sections actually address each claim.

6. Record gaps without rewriting history

Preserve the vendor’s answer, then add a separate reviewer note. Capture the concern, affected use, available compensating measure, owner, decision route, and next trigger. A vendor correction can become a new response version rather than silently replacing the original.

7. Record the decision and its trigger

State who decided, what scope was accepted, which conditions remain, and what event reopens the review. Useful triggers include a material service change, new integration, changed information flow, incident affecting the assessed scope, expired evidence, fourth-party change, or planned exit.

If your organization is completing a customer’s assessment rather than issuing one, use the responder workflow in How to answer security questionnaires: step-by-step guide.

Three failure modes reveal a weak template early

One corporate “Yes” covers several products

The answer may describe headquarters policy while the reviewed product uses a different hosting model or team. Detect this by requiring the service, environment, and evidence scope in separate fields.

Certification replaces question-level analysis

A certificate or attestation is an artifact with a stated scope, period, and exclusions. Record it in Q45, then connect it only to questions the reviewed material actually supports.

More questions replace a decision

A reviewer requests another policy whenever uncertainty appears but never states the unresolved decision. Use one follow-up field that asks: What fact would change the disposition? If no possible answer would change it, further document collection is unlikely to resolve that decision.

Excel, Word, and PDF serve different review moments

For Excel, keep formulas out of vendor-editable decision columns and protect the review log from external edits. For Word, repeat table headers across pages. For PDF, retain selectable text and explicit evidence IDs rather than embedding unlabeled screenshots.

A simple version convention such as VAQ-2026-08-v1.0 distinguishes the template release from each vendor response. Give each response its own identifier, for example VAQ-Vendor-Service-2026-08-R1. These are naming examples, not prescribed standards.

Map frameworks through a ledger, not a marketing label

Calling a questionnaire “ISO 27001 aligned,” “NIST ready,” or “CAIQ compatible” can imply more than topical overlap. Keep framework mapping in a separate ledger with seven fields: source name, source version, source control or question ID, local question ID, mapping rationale, reviewer, and verification date.

Before reproducing wording from CAIQ, HECVAT, SIG, ISO publications, or another maintained framework, obtain the current source from its owner and check its usage terms. This article intentionally supplies original questions rather than copied framework content.

A mapping ledger also exposes version drift. When a source changes, the team can inspect affected local IDs instead of renaming the entire questionnaire. The mapping remains a navigational aid; applicability, conformity, certification, and legal conclusions stay separate.

Automation fits the clerical layer; people retain the decision

Questionnaire automation can assist with importing rows, preserving IDs, detecting duplicates, routing owners, proposing evidence references, and flagging unanswered fields. Human review remains relevant where the work involves scope, exceptions, conflicting evidence, disclosure choices, or acceptance of a gap.

A generated draft is still a claim. Citation to a source document makes its basis inspectable, but the reviewer still checks whether the source covers the service and whether the wording overstates it.

Compliance Concierge addresses the responder side of this workflow: it drafts answers from a customer’s uploaded evidence, cites the supporting documents, and keeps export behind human review. It does not decide whether a vendor is suitable or turn an answer into a compliance determination. AI Security Questionnaire Automation With Human Review explains that division of work in more detail.

Frequently asked questions

What is a vendor questionnaire?

A vendor questionnaire is a structured request for supplier-provided information about a defined service or relationship. A usable version records the answer, explanation, evidence reference, evidence date, and accountable contact. The vendor supplies those fields; the reviewer records conclusions separately.

What is a vendor assessment form?

A vendor assessment form is the internal record of scope, validation, unresolved gaps, follow-up, disposition, and review triggers. It can reference a vendor questionnaire, but it should not let the supplier edit internal decision rationale.

What is a TPRM checklist?

A third-party risk management checklist tracks the wider operational process: intake, classification, questionnaire selection, evidence review, decision, monitoring triggers, and exit. The questionnaire is one input to that checklist rather than the whole process.

How many questions should a vendor assessment contain?

Question count follows scope rather than an industry-wide target. This model offers a 16-question screen, a 48-question core, and four three-question add-on packs. If every pack applies, the maximum is 60. Internal policy, contractual context, official requirements, and specialist judgment can produce a different route.

Can I use this as a free Word, Excel, or PDF template?

Yes. Paste the tables into a four-sheet workbook for routing and analysis, a Word table for narrative collaboration, or a PDF for a fixed issue copy. Preserve question IDs, version, scope, evidence references, and a separate internal review record across formats.

Can a completed questionnaire prove that a vendor is compliant?

No. It records claims, evidence, and review decisions within a stated scope. It does not establish regulatory applicability, legal interpretation, certification, or conformity by itself. Verify those matters against current official sources and qualified counsel where relevant.

What should I do first?

Create the four workbook sheets, paste Q01–Q48, and select one pilot service. Complete Q01–Q12 internally before sending the questionnaire. If those answers leave the information flow, access model, or operational dependency unknown, resolve the scope first; the remaining questions will then have something concrete to assess.