.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
What goes in a vendor risk assessment questionnaire?
Direct answer
A vendor risk assessment questionnaire asks a supplier how it protects the service, the data and the systems it touches: governance and certifications, access control, data protection and location, incident response, business continuity, its own subcontractors and its contract terms. Each question should ask for evidence where the answer matters, and the depth should follow the supplier’s risk tier.
The core question areas
- Governance: who owns security, which policies exist, which certifications or audit reports the supplier holds (ISO 27001, SOC 2) and their scope.
- Access control: multi-factor authentication, privileged access, joiners and leavers, access reviews.
- Data protection: what personal data is processed, where it is stored, encryption, retention and deletion, and whether a data processing agreement is in place.
- Operations: vulnerability management, patching, logging and monitoring.
- Incidents: how incidents are detected, how fast you are told and who your contact is.
- Continuity: backups, recovery objectives and tested continuity plans.
- Supply chain: which subcontractors the supplier relies on for your service.
- Contract: audit rights, notification duties and exit support.
Size it by tier
A long questionnaire sent to every supplier wastes everyone’s time. Score each supplier first on how much you depend on it and how far it reaches into your systems and data. Send the full questionnaire to critical suppliers, a short one to the middle tier and rely on certificates or a simple attestation for the rest. For ICT services under DORA, also ask what you need for the register of information and the Article 30 contract terms.
Ask for evidence, then rate
A Yes without proof says little. Mark the questions where evidence is required, such as a certificate, a penetration test summary or a policy, and check its date. Then rate each answer, record the gaps as findings with a recommendation, and give the supplier an overall result that feeds its risk level.
Questionnaires in Acuna GRC
In TPRM in Acuna GRC, each question carries a category, a criticality, an Evidence required toggle and translations in German, French and Spanish. You use the default templates, clone them, build your own or import them from CSV or XLSX. The supplier answers Yes, No or Not Relevant with a justification and evidence in a portal that needs no account, and answers it saved earlier pre-fill the next run. An evaluator marks each answer and rates the assessment from one to three shields. See TPRM in Acuna GRC.
How Acuna GRC handles it
In Acuna GRC you send ready-made or your own questionnaires in English, German, French or Spanish and rate each answer.
- Module
TPRM (Supplier Shield)
Suppliers, questionnaires, assessments and campaigns, with a supplier portal and supplier risk intelligence: daily scans condensed into an A to F grade, with breach and sanctions checks.
- Module
Trust Center
Answer RFPs and security questionnaires from an approved answers library and an exposure library, and share a public trust page with gated documents.
Sources
- Regulation (EU) 2022/2554 (DORA), Articles 28 and 30
- Directive (EU) 2022/2555 (NIS2), Article 21
- ISO/IEC 27001:2022, Annex A 5.19 to 5.23
This page explains the rules in general terms and is not legal advice.
Frequently asked
Can we use a standard questionnaire?
Yes. Starting from a standard template is faster and suppliers recognise it. Add the questions your sector or regulator asks for and remove the ones that do not fit the tier.
What if a supplier refuses to answer?
Record the refusal as a finding and treat the supplier as higher risk until you have evidence. For critical suppliers, make the questionnaire or an audit right a contract condition.
See how Acuna GRC runs this.
Tell us your frameworks and your team. We show you how Acuna GRC runs the program.
Hosted in Switzerland, the EU or the US