Vendor Risk Management Questionnaire: What to Ask and How
A vendor risk management questionnaire is the primary tool compliance teams use to assess supplier security, resilience, and regulatory posture.
Done well, it surfaces genuine risk.
Done poorly, it produces a paper trail that satisfies no one and protects nothing.
Trusted by 100+ organisations across Europe
NIS2 
DORA 
ISO 27001:2022 
GDPR What you need to know about vendor risk management questionnaires
- A vendor risk management questionnaire is a mandatory component of NIS2 Article 21 and DORA Article 28 compliance for European organisations.
- Questionnaires must be tiered by vendor criticality: comprehensive for critical vendors, standard for important vendors, and lightweight for low-risk suppliers.
- The five core domains every questionnaire should cover are: information security controls, data protection, business continuity, supply chain risk, and incident response.
- Self-declarations must be supported by documentary evidence for critical-tier vendors. Certificates, penetration test reports, and audit reports must be dated within acceptable timeframes.
- Questionnaire results must feed into scored risk registers, with gaps triggering tracked remediation workflows rather than being filed and forgotten.
- Reassessment cycles must be scheduled by vendor tier, with automated triggers for material events such as incidents, certificate expiry, or ownership changes.
- Fines for NIS2 non-compliance reach €10 million or 2% of global annual turnover for essential entities, making an evidenced questionnaire programme a financial necessity.
Last updated January 2025.
A questionnaire is not a box-ticking exercise. It is your audit trail.
Documented, evidenced assessments
- NIS2 Article 21(2)(d) requires essential and important entities to address supply chain security.
- DORA Article 28(3) requires a documented policy on ICT third-party risk.
- DORA Article 28(4) requires a register of all contractual arrangements with ICT third-party service providers.
- DORA Article 30 sets out mandatory contractual provisions.
- The National Competent Authority can inspect your third-party assessment records.
Penalty exposure: Fines for NIS2 non-compliance reach €10 million or 2% of global annual turnover for essential entities.
Self-declarations, generic forms, and forgotten gaps
- Sending generic questionnaires to every vendor creates vendor fatigue and wasted analyst time.
- Not following up on gaps leaves identified risk sitting in a file with no remediation owner.
- Treating self-declaration as evidence leaves critical claims unverified.
- Annual questionnaires alone do not demonstrate continuous monitoring.
- Manual calendar reminders in an inbox are not a risk management programme.
The audit reality: Regulators do not accept “we spoke to the vendor.” They expect documented, evidenced assessments.
What to Include in a Vendor Risk Management Questionnaire
Information Security Controls
This domain covers the vendor’s baseline security posture. Ask about encryption standards for data at rest and in transit, access control policies, multi-factor authentication coverage, patch management cadences, and vulnerability disclosure processes. ISO 27001:2022 certification provides baseline assurance, but it does not substitute for direct assessment. Certifications age. Controls drift. Ask for evidence dated within the last 12 months.
- Encryption standards for data at rest and in transit
- Access control policies and multi-factor authentication coverage
- Patch management cadences
- Vulnerability disclosure processes
- Evidence dated within the last 12 months
Data Protection and Privacy
Under GDPR, your organisation is responsible for ensuring that data processors and sub-processors meet appropriate standards. Ask the vendor to confirm its legal basis for processing personal data, its sub-processor list, its data retention schedules, and its breach notification timelines. The 72-hour notification obligation under GDPR Article 33 applies to you, so your vendor must be able to notify you faster than that.
- Legal basis for processing personal data
- Sub-processor list
- Data retention schedules
- Breach notification timelines
- Data residency and EU data sovereignty requirements
Business Continuity and Resilience
DORA Article 28 specifically requires financial entities to assess the operational resilience of their ICT third-party providers. Ask for recovery time objectives (RTOs) and recovery point objectives (RPOs), evidence of business continuity plan testing within the last 12 months, and documentation of past incidents and how they were resolved. A vendor that cannot demonstrate tested resilience is an operational liability, not just a compliance gap.
- Recovery time objectives (RTOs)
- Recovery point objectives (RPOs)
- Business continuity plan testing within the last 12 months
- Past incidents and how they were resolved
- Impact on your own incident response timeline
Supply Chain and Sub-contractor Risk
Your vendor’s vendor is your risk. NIS2 Article 21(2)(d) and DORA Article 28(8) both reference the need to address risks travelling through the supply chain. Ask the vendor to disclose its critical sub-contractors, confirm whether those sub-contractors are assessed under equivalent standards, and clarify contractual obligations around notifying you of material sub-contractor changes. This connects directly to fourth party risk management, which requires a separate assessment track for sub-processors and sub-contractors your vendors rely upon.
- Critical sub-contractor disclosure
- Equivalent assessment standards for sub-contractors
- Notification of material sub-contractor changes
- Sub-processor and sub-contractor assessment track
Incident Response and Notification
Ask how the vendor detects, classifies, and escalates security incidents. Specifically, ask what their internal escalation timelines look like and how quickly they would notify you of an incident affecting your data or services. Under NIS2, your organisation faces a 24-hour early warning obligation to your national competent authority. You cannot meet that timeline if your vendor takes 48 hours to tell you something happened.
- Detection and classification process
- Internal escalation timelines
- Customer notification process
- Incident impact on your data or services
- Alignment with NIS2 early warning timelines
Questionnaire Depth by Vendor Criticality
Questionnaires vary in depth depending on the vendor’s criticality tier. The vendor risk management process determines which tier applies before a questionnaire is ever sent.
StartComply automates questionnaire distribution, scoring, evidence collection, and escalation workflows so the output feeds directly into your risk register.
What Is a Vendor Risk Management Questionnaire?
A vendor risk management questionnaire is a structured set of questions sent to a third-party supplier to assess its information security controls, data handling practices, business continuity arrangements, and regulatory compliance posture. It is the foundation of third-party due diligence.
The questionnaire is not a box-ticking exercise. It is a formal mechanism for evidencing that your organisation has assessed supplier risk, a requirement that sits explicitly within NIS2 Article 21(2)(d) and DORA Article 28(3). Regulators do not accept “we spoke to the vendor.” They expect documented, evidenced assessments.
Questionnaires vary in depth depending on the vendor’s criticality tier. A critical ICT service provider handling core financial infrastructure demands a comprehensive 80-question assessment mapped to DORA’s technical standards. A low-risk software vendor supplying a productivity tool may require only a lightweight 20-question security review. The vendor risk management process determines which tier applies before a questionnaire is ever sent.
StartComply automates the entire workflow. Build question sets mapped to specific regulatory requirements, chase responses, score risk, and generate audit-ready evidence from one platform.
How to Structure the Questionnaire Distribution Process
Begin by tiering your vendor population Due diligence
Not every supplier needs the same depth of assessment. Critical vendors, those providing essential ICT services, processing sensitive data, or operating in regulated sectors, require comprehensive assessments. Important vendors require a standard review. Low-risk vendors require a lightweight screen. A vendor risk management framework should define these tiers before questionnaires go out.
Send questionnaires with clear ownership Distribution
Once tiers are set, dispatch questionnaires with a clear deadline and a named contact for queries. Response rates drop sharply without a deadline and a named escalation path. Build in a chase sequence: an automated reminder at seven days, a manual escalation at 14 days, and a risk flag at 21 days if no response has been received.
Translate raw responses into risk ratings Risk scoring
Raw questionnaire responses need to translate into a risk score. A simple scoring model assigns weighted values to each domain, then aggregates to a total risk rating: high, medium, or low. Weight critical domains such as incident response and data protection more heavily than administrative domains.
Collect and assess supporting evidence Evidence
A questionnaire response is a vendor’s self-declaration. It is a starting point, not a conclusion. Critical-tier vendors require documentary evidence to support their answers: certificates, penetration test reports, audit reports, and policy documents. Evidence should be dated and assessed for relevance.
Turn questionnaire results into ongoing risk management Continuous monitoring
A vendor risk management questionnaire is not a one-time event. The vendor risk management lifecycle makes clear that assessment is continuous. Vendors change. Their sub-contractors change. Their security posture degrades. Your questionnaire process must reflect that reality.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About Vendor Risk Management Questionnaires
How often should I send a vendor risk management questionnaire?
Frequency depends on the vendor’s criticality tier. Critical vendors, those providing essential ICT services or handling sensitive data, should be reassessed annually at minimum. Important vendors can operate on an 18-month cycle. Low-risk vendors on two years. Additionally, any material incident, significant infrastructure change, or ownership change at a vendor should trigger an out-of-cycle reassessment regardless of when the last questionnaire was completed. DORA’s continuous monitoring requirements for financial entities mean critical ICT third-party providers may require more frequent touch-points than an annual questionnaire alone provides.
What is the difference between a vendor questionnaire and a vendor audit?
A vendor questionnaire is a self-assessment: the vendor answers your questions and provides supporting evidence. A vendor risk management audit is an independent verification, either conducted by your team on-site or by a third-party assessor, of whether the vendor’s actual controls match their declared posture. Questionnaires are efficient and scalable across large vendor populations. Audits are resource-intensive but provide higher assurance. Critical vendors under DORA should be subject to both, with questionnaire responses verified through periodic audits or third-party attestations.
Can I use a standard questionnaire template or do I need to build my own?
Industry-standard frameworks such as the Standardised Information Gathering (SIG) questionnaire or the Cloud Security Alliance CAIQ provide useful starting points. However, they must be adapted to reflect your specific regulatory obligations. A financial entity under DORA has different mandatory assessment areas than a healthcare organisation under NIS2. Mapping questionnaire sections to specific regulatory articles ensures your assessment programme produces evidence that satisfies regulators, not just a generic compliance checklist. StartComply provides pre-built questionnaire templates mapped to NIS2 and DORA requirements.
What happens if a vendor refuses to complete our questionnaire?
Refusal or persistent non-response is itself a risk indicator. Document the refusal formally in your risk register. For critical-tier vendors, refusal to engage with a risk assessment should trigger a review of whether the relationship can continue under your regulatory obligations. NIS2 and DORA both require that you can evidence your assessment of third-party risk. If a vendor will not cooperate, you cannot meet that requirement. Contractual provisions requiring vendors to cooperate with security assessments should be included in your standard supplier agreements.
How do I score vendor questionnaire responses objectively?
Define a scoring model before sending questionnaires, not after receiving responses. Assign each question a point value, weight critical domains such as incident response and data protection more heavily, and establish score thresholds that correspond to risk ratings: high, medium, and low. Apply the model consistently across all vendors in the same tier. Document the scoring methodology so that any assessor produces the same result from the same set of responses. Automated scoring through a platform like StartComply removes the subjectivity and inconsistency that manual spreadsheet scoring introduces.
Does a vendor’s ISO 27001 certification mean I don’t need to send a questionnaire?
No. ISO 27001 certification confirms that a management system was in place at the time of audit. It does not confirm that controls remain operational today, that they cover the specific services provided to you, or that they address your specific regulatory requirements under NIS2 or DORA. Certification is baseline assurance, not a substitute for assessment. Use it as a positive indicator when scoring questionnaire responses, and request the certificate with its issue date and scope. A certificate that excludes the relevant service or is more than 12 months old adds limited assurance.
Stop Chasing Vendor Questionnaires by Email.
Regulatory Requirements Driving Questionnaire Obligations
European regulations are explicit about third-party risk assessment. Understanding which articles apply to your organisation shapes what your questionnaire must cover.
For Critical ICT Third-Party Service Providers designated under DORA Article 31, oversight is directly exercised by the Lead Overseer, not just your internal team. The questionnaire record must demonstrate continuous monitoring, not just a one-time assessment.
Vendor Questionnaire Follow-Up Timeline
Tier your vendor population before questionnaires go out.
Dispatch questionnaires with a clear deadline and a named contact for queries.
Send an automated reminder if no response has been received.
Escalate manually through the named escalation path.
Raise a risk flag if no response has been received.
Trigger out-of-cycle reassessments following material incidents, significant infrastructure changes, ownership changes, certificate expiry, or risk score changes.
Critical vendor signal: Refusal or persistent non-response is itself a risk indicator. Document the refusal formally in your risk register and review whether the relationship can continue under your regulatory obligations.
Common Failures in Vendor Questionnaire Programmes
Most vendor questionnaire programmes fail in predictable ways. Identifying these failure modes prevents you from repeating them.
Sending Generic Questionnaires to Every Vendor
A 150-question enterprise security questionnaire sent to a low-risk software-as-a-service provider produces two problems: vendor fatigue and wasted analyst time reviewing irrelevant responses. Tiered questionnaires matched to vendor criticality produce better response rates and more useful data. Build three questionnaire templates: comprehensive, standard, and lightweight.
Not Following Up on Gaps
A vendor marks “no” to “Do you conduct annual penetration testing?” You file the response. Nothing happens. This is the most common failure in vendor questionnaire programmes. Every identified gap must generate a remediation request with a deadline, an owner, and a tracked status. Gaps that are accepted rather than remediated must be formally risk-accepted and documented.
Treating Self-Declaration as Evidence
Vendors answer questionnaires in their best interest. A response of “yes, we encrypt all data at rest” is a claim. Without supporting evidence, it is not proof. Your questionnaire process must specify which responses require documentary evidence and enforce that requirement before closing the assessment. This is particularly critical for vendors classified as high-risk or critical.
