Vendor risk: the security questionnaire questions that matter

Many vendor security questionnaires run to hundreds of questions. Suppliers fill them in with copy-pasted answers, buyers skim them, and real risks get missed. A shorter questionnaire focused on the controls that most often decide outcomes is easier to answer honestly and easier to act on. Under Australian Privacy Principle 11, you remain responsible for taking reasonable steps to protect personal information, including when a vendor handles it.

First, tier your vendors

Not every supplier deserves the same scrutiny. Tier them by what they can access and how much you depend on them.

• High: holds sensitive or personal data, has access to your systems, or would stop your business if it failed.
• Medium: limited data access or a replaceable service.
• Low: no data access and easily substituted.

Send the full set of questions below to high-tier vendors, a subset to medium, and a simple acknowledgement to low.

The questions that matter

Identity and access

• Is MFA enforced for all staff accessing systems that store our data, including administrators and support staff?
• How is access granted, reviewed and removed when staff leave?
• Can your staff access our data, and is that access logged?

Data protection

• Where is our data stored and processed, including backups and subprocessors?
• Is data encrypted in transit and at rest?
• How is our data separated from other customers' data?
• What happens to our data when the contract ends?

Vulnerability and change management

• How quickly do you patch critical vulnerabilities in internet-facing systems?
• When were your systems last independently tested, and can you share a summary?

Incidents and resilience

• How quickly will you notify us of an incident affecting our data, and through what channel?
• Have you had a security incident affecting customer data in the last three years?
• Are backups tested, and what are your recovery time and recovery point targets?

Assurance

• Do you hold a current ISO 27001 certificate or SOC 2 report covering the service we use?
• Which subprocessors handle our data?

Reading the answers

• Good: specific, scoped answers that admit limitations and give timeframes.
• Worrying: "industry standard security" with no detail, refusal to name subprocessors, or certificates whose scope excludes the service you use.
• Red flags: no MFA for administrators, no incident notification commitment, or unclear data location for sensitive data.

Turn answers into action

A questionnaire is only useful if weak answers lead somewhere. For each gap, decide whether to accept it, ask the vendor to fix it by a date, add a contract clause, or choose another supplier. Record the decision and its owner.