Sending every vendor a 200-question security questionnaire means nobody reads the answers. This one tiers vendors by what they can actually damage, and asks a proportionate set, with evidence required rather than self-attestation at the top tier.
What you get
A tiering model based on data access and business dependency
Question sets scaled to tier, so low-risk vendors are not over-assessed
Evidence requirements rather than yes/no self-attestation
A findings and conditions record for contract negotiation
How to use this template
1
Tier before you assess. A vendor holding customer personal data and one supplying stationery do not need the same scrutiny. Tier on data accessed, system access granted, and whether an outage stops your business.
2
Ask for evidence, not assertions. At tier 1, request the SOC 2 Type II report or ISO certificate and actually read the exceptions and the scope. Self-attested questionnaires tell you what the vendor's sales team believes.
3
Turn findings into contract conditions. An assessment whose findings do not reach the contract has changed nothing. Breach notification timelines, audit rights, subprocessor notification, and data return on termination all belong in the agreement.
What's inside
Here's a preview. Unlock the free download to get all 3 sections (2 more below).
Vendor tiering
Tier first. This determines how much assessment is proportionate.
Tier
Criteria
Assessment required
Evidence required
Reassessment
Tier 1 (critical)
Holds customer personal data, or has production system access, or an outage stops operations
Full questionnaire plus evidence review
SOC 2 Type II or ISO 27001, pen test summary, DPA
Annually
Tier 2 (important)
Holds internal data, or a sustained outage would disrupt a department
Short questionnaire
Certification if held; DPA where personal data is involved
RFPs produce incomparable responses because each vendor answers in their own structure and prices in their own format. Fixing the requirement format and the pricing table is what makes a side-by-side comparison possible at all.
Vendor exits leave a long tail: integrations still calling an API, a direct debit still running, and your data sitting on their platform indefinitely. The data extraction in particular has a deadline you usually cannot extend.
Most software evaluations are a decision already made, dressed in a scoring matrix afterwards. The two things that prevent that are locking weights before you see proposals, and requiring evidence rather than impressions in each cell.
By what they can actually damage: whether they hold personal or confidential data, whether they have access to your systems, and whether their outage stops your operations. Tier 1 warrants evidence review; tier 3 needs only basic due diligence.
What evidence should a critical vendor provide?
+
A current SOC 2 Type II or ISO 27001 certificate with scope covering the service you are buying, a penetration test summary, and an acceptable data processing agreement. Read the exceptions in the report rather than only the opinion.
What should come out of a vendor risk assessment?
+
Contract conditions. Breach notification timelines, subprocessor notification rights, data return and deletion terms, and audit rights are where an assessment turns into actual protection. Findings that stay in a spreadsheet change nothing.
