Vendor Risk Assessment Questionnaire: What to Ask
A vendor risk assessment questionnaire is the primary instrument for gathering security, compliance, and operational evidence from third parties. StartComply automates the full questionnaire lifecycle, from tailored question sets and evidence requests to scoring, remediation, and audit-ready reporting.
Trusted by 100+ organisations across Europe
NIS2 
DORA 
ISO 27001:2022 
Vendor assessments What you need to know about vendor risk assessment questionnaires
- A vendor risk assessment questionnaire must gather evidenced control data, not just self-attestation. Regulators audit the evidence, not the claims.
- Tier your questionnaires by vendor risk level. Tier 1 critical ICT providers require 80 to 120 questions with evidence attachments. Tier 3 low-risk vendors need 15 to 20 screening questions at most.
- Map every question to a regulatory control requirement: NIS2 Article 21, DORA Article 28, or ISO 27001:2022 Annex A.5.19 to A.5.23.
- Non-compliant responses must generate findings with deadlines, escalation paths, and tracked remediation. A questionnaire without remediation management is just an archive.
- Annual questionnaires capture point-in-time snapshots. Continuous monitoring provides the signal layer that triggers out-of-cycle reassessments when vendor risk changes.
- NIS2 fines can reach €10 million or 2% of global annual turnover. Questionnaire evidence is a primary line of defence during regulatory inspection.
Last updated May 2026.
Vendor Questionnaires Are Audit Evidence, Not Admin Work
A structured, evidenced questionnaire programme
- NIS2 Article 21: supply chain security and supplier relationship controls
- DORA Article 28: ICT third-party risk assessment and provider register inputs
- DORA Article 30: contractual evidence for incident notification, audit rights, and exit planning
- ISO 27001:2022 Annex A.5.19 to A.5.23 supplier relationship controls
- Tracked remediation for non-compliant responses and open findings
Penalty exposure: NIS2 fines can reach €10M or 2% of global annual turnover for essential entities. Sources: NIS2 Directive, DORA Regulation.
Long forms, slow follow-ups, weak evidence
- The same 200-question form sent to every vendor regardless of risk
- Self-attestation accepted without evidence attachments
- No mapping between questions and regulatory obligations
- Unclear ownership when vendors fail to respond or remediate
- Point-in-time assessments with no continuous monitoring trigger
- No audit trail showing dates, decisions, escalations, and closures
The audit reality: regulators do not only ask whether you sent a questionnaire. They ask what evidence was received, how gaps were scored, who approved the risk, and what happened next.
Everything Your Vendor Questionnaire Programme Needs
Tiered Questionnaire Library
StartComply helps you avoid one-size-fits-all questionnaires by activating the right question set for each vendor tier, service category, and regulatory exposure. Critical vendors get deeper diligence; low-risk suppliers get fast, automated screening.
- Tier 1, Tier 2, and Tier 3 questionnaire structures
- Question banks mapped to NIS2, DORA, GDPR, and ISO 27001
- Configurable questions by data access, ICT dependency, and service criticality
- Reusable templates for onboarding, renewal, and incident-triggered reassessment
Automated Evidence Collection and Scoring
Stop chasing vendors through email threads. StartComply distributes questionnaires automatically, requests supporting documents, scores responses against your risk model, and flags gaps for review. Evidence collection becomes repeatable, not dependent on spreadsheet discipline.
- Automated distribution, reminders, and response tracking
- Mandatory evidence attachments for high-risk control domains
- Weighted scoring by vendor tier and question category
- Residual risk ratings that feed your vendor register
Gap Management and Continuous Monitoring
Questionnaire responses only matter if your team acts on them. StartComply turns non-compliant answers into findings, assigns remediation owners, tracks deadlines, and triggers reassessment when monitoring signals change. Open gaps stay visible until they are resolved or formally accepted.
- Findings generated from non-compliant or incomplete responses
- Remediation deadlines, escalation paths, and closure evidence
- Threat intelligence, adverse news, and certificate expiry signals
- Out-of-cycle reassessments for incidents and material vendor changes
StartComply vs. The Questionnaire Alternatives
Not every questionnaire process produces evidence that satisfies NIS2, DORA, and ISO 27001 expectations. The difference is what happens after the answers arrive.
StartComply was built for compliance teams that need questionnaires to produce usable risk evidence, not another folder of unstructured vendor replies.
What Is a Vendor Risk Assessment Questionnaire?
A vendor risk assessment questionnaire is a structured set of questions sent to a third party to evaluate their information security posture, operational resilience, data handling practices, and regulatory compliance status. It is not a checklist. It is an evidence-gathering instrument.
The distinction matters. A checklist asks vendors to confirm they have controls in place. A questionnaire asks them to evidence those controls: produce policies, share audit reports, name their subprocessors, and describe their incident response procedures. Evidence, not self-attestation, is what regulators audit.
Questionnaires sit within the wider vendor risk assessment process, which also includes inherent risk scoring, contractual controls, and ongoing monitoring. The questionnaire is typically deployed after an inherent risk score is assigned and before onboarding is approved. For high-risk vendors, it may be repeated annually or triggered by a security incident.
Questionnaire vs Template: What Is the Difference?
A questionnaire is the live instrument sent to a vendor. A vendor risk assessment template is the reusable framework from which questionnaires are built. Templates define question banks, scoring criteria, and risk thresholds. Questionnaires are the deployed instances, customised by vendor tier, category, and regulatory exposure.
Teams that conflate the two send every vendor the same form regardless of risk. That approach burns vendor goodwill, slows onboarding, and produces data of inconsistent quality. The correct approach is a tiered template library with questions activated by risk profile.
Evidence, not self-attestation, is what regulators audit. StartComply turns questionnaires into structured risk evidence by linking every answer to controls, documents, scores, findings, and decisions.
How to Run a Vendor Risk Assessment Questionnaire in Five Steps
Tier vendors before asking questions Inherent risk
Start with inherent risk factors: data access, system integration, operational dependency, regulatory criticality, and concentration exposure. This prevents low-risk vendors from receiving unnecessary deep-diligence questionnaires and ensures critical providers receive the scrutiny they require.
Match question depth to vendor tier Tier 1 / 2 / 3
Activate the right question set based on vendor tier. Tier 1 vendors should receive full control coverage with mandatory evidence attachments. Tier 2 vendors need focused diligence. Tier 3 vendors should receive short screening questionnaires.
Request evidence, not just answers Audit evidence
Ask for policies, certifications, audit reports, penetration test summaries, subprocessor lists, incident procedures, and business continuity test evidence. A yes/no response is not enough when the control is material to your risk exposure.
Convert responses into residual risk Risk thresholds
Score every response against your risk model and vendor tier. A missing MFA policy from a critical ICT provider should carry more weight than the same gap from a low-risk commodity supplier. The output should feed your vendor register and onboarding decision.
Track findings to closure ISO 27001 Clause 8.4
Turn non-compliant responses into findings with owners, deadlines, escalation rules, and closure evidence. If critical vendors fail to remediate, escalate the risk decision and document whether the relationship can continue.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About Vendor Risk Assessment Questionnaires
How many questions should a vendor risk assessment questionnaire contain?
It depends entirely on vendor tier. Tier 1 critical ICT and data processors warrant 80 to 120 questions covering all major control domains, with mandatory evidence attachments. Tier 2 significant vendors should receive 40 to 60 questions. Tier 3 low-risk vendors need no more than 20 screening questions. Questionnaire depth should follow risk, not internal habit.
What is the difference between a vendor risk questionnaire and a security questionnaire?
A security questionnaire focuses narrowly on information security controls such as access management, patch cadence, encryption, and incident response. A vendor risk assessment questionnaire is broader. It also covers operational resilience, data protection, business continuity, subprocessor management, and regulatory compliance status. For NIS2 and DORA compliance, you need the broader vendor risk format, not just a security questionnaire.
How often should vendor risk assessment questionnaires be sent?
Tier 1 critical vendors should be reassessed annually as a minimum, with out-of-cycle assessments triggered by incidents, significant contract changes, or adverse news. Tier 2 vendors typically warrant annual or biennial reassessment. Tier 3 vendors can be reassessed every two to three years. NIS2 Article 21 requires continuous monitoring of supply chain security, so questionnaire cycles should be supplemented by automated monitoring.
Can I use a standard questionnaire framework like SIG or CAIQ for NIS2 compliance?
Frameworks like the Shared Assessments SIG and Cloud Security Alliance CAIQ provide useful question banks, but they are not mapped to NIS2 or DORA by default. You need to cross-reference questions against NIS2 Article 21 and DORA Article 28 obligations to confirm coverage. Gaps are common around incident notification timelines, concentration risk, and GDPR subprocessor obligations. Treat them as starting points, not complete frameworks.
What evidence should vendors provide alongside questionnaire responses?
For Tier 1 vendors, require a current ISO 27001 or SOC 2 Type II certificate covering the relevant service scope, a penetration test executive summary from the last 12 months, a named incident notification commitment with 24-hour and 72-hour timelines, a current subprocessor list, and evidence of the most recent business continuity test. Self-attestation without documents is insufficient for regulatory audit purposes.
What happens when a vendor fails to respond to a questionnaire?
Non-response is itself a risk indicator and must be treated as such. Set a clear response deadline in onboarding or renewal workflows. If the vendor misses the deadline, escalate to a senior vendor contact. If non-response continues, the vendor should be flagged as non-assessed in your register, which may block onboarding or trigger contractual review. For critical vendors, persistent non-response may require executive escalation or formal notice.
Stop Running Vendor Questionnaires Through Spreadsheets.
How to Tier Your Vendor Risk Assessment Questionnaire by Risk Level
Sending the same questionnaire to every vendor is operationally wasteful and analytically useless. Tiering is not about reducing diligence on important vendors. It is about concentrating diligence where risk is highest. Classify vendors before questionnaires are deployed, using data access, system integration, regulatory criticality, and concentration risk.
Do not waste analyst time on deep assessments for Tier 3 vendors. Automate distribution and scoring for low-risk vendors, and reserve manual review for critical control gaps and high-impact supplier relationships.
Vendor Questionnaire Workflow: From Launch to Monitoring
Assign inherent risk tier based on data access, service criticality, system integration, and regulatory exposure.
Send the tier-specific questionnaire with clear evidence requirements, response deadlines, and vendor ownership.
Score responses, validate attachments, identify non-compliant controls, and request clarifications where evidence is weak.
Approve, reject, escalate, or conditionally accept the vendor based on residual risk and documented remediation commitments.
Trigger reassessment when incidents, contract changes, adverse news, or monitoring signals indicate that vendor risk has changed.
Do not approve critical vendors on incomplete evidence. If a Tier 1 vendor cannot evidence access controls, incident notification, business continuity, or subprocessor management, the risk decision should be escalated and documented before onboarding or renewal.
Core Categories Every Vendor Risk Assessment Questionnaire Must Cover
Regulators do not prescribe a single question list, but they do expect coverage of the control domains that drive third-party risk. Map every question to a domain so you can demonstrate why it exists.
Information security and access controls
Ask how vendors manage privileged access, multi-factor authentication, access reviews, joiner-mover-leaver processes, and offboarding.
Incident detection and response
Confirm the vendor’s incident handling capability, escalation contacts, and notification commitments, including 24-hour early warning and 72-hour notification timelines where relevant.
Business continuity and recovery
Request recovery time objectives, recovery point objectives, resilience testing evidence, and results from the most recent business continuity exercise.
Data protection and subprocessor management
Ask which personal data categories are processed, where data is stored or transferred, and which subprocessors support the vendor service.
Vulnerability management and patch cadence
Assess vulnerability scanning, bug bounty coverage, critical patch timelines, customer notifications, and evidence that vulnerabilities are remediated promptly.
