How to build a vendor risk assessment questionnaire vendors actually finish

Questionnaires fail on both sides of the table for the same reason: nobody is clearly on the hook. Internally, the security questionnaire gets written by InfoSec, sent by procurement, scored by nobody and filed by the business owner who wanted the vendor approved yesterday. On the vendor side it lands with the salesperson, who is the one person in the company who cannot answer it.

Fix the internal side first. The third-party risk team owns the template, the tiering rules and the release cycle. Each risk domain has a named reviewer who writes the questions for that domain, decides what evidence is acceptable and scores the answers. Procurement or the business sponsor owns the vendor relationship and the deadline. Nobody else edits the template.

Then fix the vendor side with two asks on the intake form: the name and email of the person who will coordinate the response, normally the vendor's security or compliance lead, and a sentence that says which decision the questionnaire supports and when it is due. Vendors answer faster when they know the answer gates a signature on a specific date.

Writing 200 questions from scratch gives you 200 questions nobody else asks, which means every vendor answers them for the first time, for you alone. Start from a published standard instead. Your vendors have answered it before, your reviewers can map it to your baseline, and your auditors recognize it.

The SIG security questionnaire from Shared Assessments is the default for most programs. Shared Assessments publishes it in three tiers, the SIG Lite, the SIG Core and the SIG Detail, so you can scope the ask to the relationship rather than send everyone the full set. The current SIG covers 21 risk domains, from Access Control and Cloud Services through Nth Party Management, Supply Chain Risk Management and a dedicated Artificial Intelligence domain, and Shared Assessments maps it to ISO 27001:2022, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 3 and NIST SP 800-161 Rev. 1. If you are new to it, Certa's SIG security questionnaire guide walks through the structure.

If you need a NIST vendor risk assessment questionnaire, the source document is NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, published in May 2022 and updated in November 2024. It is written for the acquirer, not the vendor, which is what makes it useful: it describes how to identify, assess and mitigate cybersecurity risk across the supply chain at every level of the organization, and its supplemental material includes a SCRM Assessment Scoping Questionnaire (Table 26) you can adapt. Use the NIST supply chain risk practices when your vendors supply hardware, firmware, software components or managed services into regulated or defense environments.

For cloud providers, the Cloud Security Alliance's Consensus Assessment Initiative Questionnaire (CAIQ) is built on the Cloud Controls Matrix, 197 control objectives across 17 domains, with the two combined in version 4.1. Many cloud vendors keep a completed CAIQ on file.

A vendor security assessment questionnaire should get shorter as the risk gets lower. That sounds obvious, and almost every program violates it, because a single "master" template is easier to maintain than four. The cost of that convenience is paid by the medium-risk vendor who gets 220 questions and never returns them.

Tier at intake, before anything goes out. The inputs that matter: what data the vendor will hold or access (regulated, confidential, internal, public), whether they connect to your network or identity provider, whether they support a critical or important function, how hard they are to replace, where they operate and who their subprocessors are. Spend is a weak proxy on its own. A $20,000 SaaS tool with admin access to your HR system is Tier 1. A $2 million facilities contract may be Tier 3. Certa's third-party vendor assessment guide covers the inherent-risk inputs in more detail.

Then map each tier to a question count, an evidence expectation and a review depth. The ranges below are a working starting point for a mature program, not a rule. Tune them to your own completion data after two cycles.

Conditional logic does the rest. A question about encryption of data at rest only appears when the vendor stores your data. A subprocessor section only opens when the vendor hosts in the cloud. A question about ITAR-controlled technical data only appears for suppliers flagged as defense. Branching lets a single template behave like four without four templates to maintain.

Deciding what to include in a vendor risk questionnaire comes down to one test per question: would a bad answer change a decision? If a "no" would not block approval, trigger remediation, change the tier or alter a contract term, the question is costing the vendor time and giving you nothing. Cut it.

For a Tier 1 or Tier 2 service provider, the domains that pass that test usually look like this:

• Governance: who owns security, which framework they follow, when policies were last reviewed, whether a current SOC 2 or ISO 27001 report exists
• Access control and identity: MFA for administrative and remote access, joiner and leaver process, privileged access review cadence
• Data protection and privacy: data classification, encryption in transit and at rest, retention and deletion, data residency, lawful basis where personal data is involved
• Cloud and infrastructure: hosting model, environment separation, vulnerability management, patch timelines, hardening standards
• Incident management: detection, breach notification time frame to customers, post-incident review, incidents in the last 24 months
• Resilience: business continuity and disaster recovery plans, recovery time and recovery point objectives, date of the last test and its result
• Subprocessors and fourth parties: who they are, where they are, how the vendor assesses them, how you are told when they change
• Compliance and legal: regulatory licenses, sanctions screening of their own supply chain, insurance, litigation and regulatory actions
• AI use: whether your data trains models, whether AI features touch your data, and who governs them. The SIG now carries a dedicated AI domain for a reason

The Interagency Guidance names the same ground for banking organizations: information security, operational resilience, subcontractors, insurance coverage, legal and regulatory compliance, and the third party's ability to perform the activity. Financial condition belongs in Tier 1 as well, and the guidance points you at audited financial statements and public filings rather than a questionnaire answer.

What to leave out matters as much. Anything a SOC 2 Type II report already answers gets read from the report. Anything you cannot verify becomes an attestation line. Anything you will not score comes off the form.

The question that kills a vendor questionnaire is "Describe your approach to security." It cannot be answered wrong, it cannot be scored, and the vendor's answer will be three paragraphs of marketing. Every question in your template should have a closed answer, an evidence request and, where the control is time-bound, a date.

Four rules keep questions answerable. One control per question, so a vendor is never forced to answer yes to half a sentence. Defined terms, so "regularly" becomes "at least every 90 days" and "sensitive data" points at your classification. A named artifact, so the vendor knows what to upload before they start writing. And a legitimate way out: "Not applicable, because" with a mandatory reason, so a vendor that does not host data is not penalized for lacking a data center policy.

The security questionnaire examples below show the rewrite. The left column is what most templates ask. The middle column is what gets finished.

Every rewrite can be answered in a minute by someone who has the document and not at all by someone who does not. The questionnaire becomes an evidence index, and the review becomes reading evidence rather than grading prose.

Follow-up is where the weeks go. The vendor misses a section, the analyst emails, the vendor's coordinator is on leave, the analyst emails again, and the deadline moves twice. Security questionnaire automation should remove the follow-up before it starts, in four ways.

1. Prefill from what you already hold: last cycle's answers, the vendor's published trust page and the SOC 2 report on file populate the form before the vendor opens it. The vendor confirms or corrects rather than writing from blank.
2. Branch on the tier and on earlier answers, so the form a vendor sees is the form that applies to them.
3. Chase on a schedule the vendor can see: a reminder at the halfway point, one at three days out, and an escalation to the business sponsor at the deadline, with the completion percentage in every message.
4. Track evidence expiry. A SOC 2 report has a period end date and a certificate has an expiry, so automation asks for the new one when the old one lapses instead of waiting for the annual cycle.

This is where Certa's Pre-Fill Agent does its work. It pulls third-party data from websites, news and documents and pre-populates forms and DDQs, so the vendor is confirming evidence instead of retyping it. The capability was introduced on Certa's resource page as Certa SmartFill AI, and it now runs as the Pre-Fill Agent on the platform. A global life sciences leader with more than 50,000 third parties uses it to automate 1,000+ monthly third-party requests through DDQ pre-fill across 20 risk domains, with its analysts reviewing the pre-filled answers rather than chasing them.

Keep the human decision. Prefilled answers are proposals until a reviewer confirms them, the rationale and data sources behind each prefill should be visible, and the vendor still signs an attestation at the end. Automation shortens the path to a decision. It does not make the decision.

A vendor risk management questionnaire without a scoring model is a reading assignment. Build the model before the first response arrives, and build it so that most responses never need a human.

Give every question a weight inside its domain and a pass condition. Roll questions up to a domain score, and domain scores up to a control rating for the vendor. Residual risk is that control rating read against the inherent tier: a Tier 1 vendor with weak resilience controls is an exception, a Tier 3 vendor with the same answer is a note on the file. Three outcomes are enough for the rating: approve, approve with remediation, or escalate.

• Approve: every gating question passes, evidence is current, residual risk is inside appetite for the tier. Auto-disposition, with the rationale written to the audit trail.
• Approve with remediation: non-gating gaps only. The domain reviewer issues findings with owners and due dates, the vendor accepts them in the portal, and the contract carries the commitment.
• Escalate: a gating question fails, evidence is missing or expired, or the vendor's answers contradict the evidence. Routed to the domain reviewer with a service level, then to a risk committee if the business still wants to proceed.

Route exceptions, not questionnaires. The reviewer should open a queue of failed gating questions and contradictions, each with the vendor's answer and evidence beside it, not a 180-row spreadsheet. Record the rationale for every disposition, because that rationale is what an examiner reads two years later.

Certa's supplier onboarding module runs this routing inside the intake flow, so your team works the exceptions rather than the whole queue. Quantcast used that model to automate its financial, legal, privacy and infosec checks and cut vendor onboarding to a 7-day cycle for high-risk vendors and 5 days for low-risk ones.

Last, schedule the reassessment at the moment you score, and write the next date into the vendor record now rather than at the start of the next annual cycle.