Pre-Workshop Form: Vendor Security Questionnaire Workshop

For workshop participants.
This form takes about 5 minutes. Your answers will let us arrive at the workshop with a first draft of the questionnaire already aligned with your priorities, so we can spend the session on decisions rather than framing.

1. Purpose of the questionnaire

What is the main objective of the questionnaire?

Assess the vendor's cybersecurity maturity level

Verify regulatory compliance (NIS2, DORA, GDPR, AI Act…)

Support the decision before contracting (go / no-go)

Feed continuous monitoring of existing vendors

Produce compliance deliverables (e.g. Security Assurance Plan)

In your view, what is the ideal number of questions?

Fewer than 30 questions

30 to 60 questions

Should we plan variants depending on the criticality of service provided?

Yes — a short questionnaire for low-criticality vendors, an in-depth one for critical vendors

No — a single questionnaire for all

No opinion / to be discussed in the workshop

Should we plan variants depending on the type of service provided?

Yes — SaaS vs non-SaaS (on-premise software, consulting, hosting…)

Yes — depending on the vendor's use of AI (AI-specific module)

No — one common set of questions for all service types

Which of the following themes are priorities for you?

Security governance and organisation (policies, responsibilities)

Certifications and compliance (ISO 27001, SOC 2…)

Personal data protection / GDPR

Identity and access management (IAM, MFA, SSO)

Endpoint and network protection (EDR, NDR, anti-DDoS, firewall…)

Incident detection and response (SIEM, SOC, crisis management)

Application security and secure development

Cloud security and data hosting (location, reversibility)

Vulnerability management and penetration testing

Business continuity and disaster recovery (BCP / DRP, backups)

Fourth-party risk (the vendor's own subcontractors)

Vendor's use of AI (training data, AI Act)

Security awareness and training

Are there themes to exclude or cover only lightly?

Do you have any must-have or "signature" questions that should absolutely be included?

Example: MFA enforced on all employee inboxes

Evidence and documents

Which key documents would you want to collect as a priority?

ISO 27001 / SOC 2 certificate or audit report

Information security policy (ISP)

Latest penetration test report (or summary)

Business continuity / disaster recovery plan (BCP / DRP)

Data processing agreement (DPA) / GDPR documentation

Incident response plan

Cyber insurance certificate

Architecture / data flow diagram

Subcontractor / fourth-party list

AI policy or AI Act documentation

Frameworks and existing material

Should the questionnaire be aligned with a framework?

Existing internal framework

No particular alignment

Do you already have a vendor questionnaire?

Yes, and it should be largely reused

Yes, but it needs to be reworked

No, we're starting from scratch