Vendor Risk Assessment: Supplier Security Questionnaire and Process

A vendor risk assessment is the check you carry out on a supplier before it gets access to your data, systems or payment flows, and again when the contract renews. It has four steps: rate how much risk the supplier could bring, send a security questionnaire sized to that risk, verify the evidence behind the answers, and record a decision. The evidence matters more than the questionnaire. A “yes” to “do you use multi-factor authentication?” is a claim; a current certificate or Attestation of Compliance is something you can check.

This guide covers the assessment itself, with a template to copy. For the wider programme (inventory, contracts, monitoring and exit), see our guide to third-party risk management.

What is a vendor risk assessment?

A vendor risk assessment, also called a third-party risk assessment, supplier security assessment or third-party due diligence, measures the security risk that one supplier brings. It separates two things:

• Inherent risk: what could go wrong because of what the supplier does for you, before considering its controls. A payroll bureau holding staff bank details is high; a stationery supplier is close to zero.
• Residual risk: what remains once you have checked its controls and evidence. You make the decision on this.

The output is an assessment record: questionnaire, evidence, gaps, decision, decision-maker and review date. ISO 27001 and PCI DSS auditors ask to see these records. Attacks that arrive through suppliers’ software and updates also need technical controls, covered in our guide to supply chain security.

How to do a supplier risk assessment in six steps

To do a supplier risk assessment, rate the supplier’s inherent risk, send a questionnaire sized to it, collect evidence, verify that evidence, score the gaps and record a decision with a review date. The sections below cover each step in detail.

1. Tier the supplier. Use a short intake form to rate inherent risk from the data it will hold, its access to your systems and how critical the service is.
2. Send a questionnaire sized to the tier. The full twelve sections for critical suppliers, the first five for lower tiers.
3. Collect evidence with each answer. Certificates, an Attestation of Compliance, a penetration test summary, policies and the data processing agreement.
4. Verify the evidence. Check dates, scope and the issuing body, for example on the IASME certificate search or with the certification body.
5. Score each section. Rate it as meets, partly meets or does not meet, weighted for what matters with this supplier.
6. Decide and set a review date. Approve, approve with conditions, escalate or decline, then record who decided and when the supplier will be reassessed.

How do you decide how deep each assessment should go?

Rate inherent risk first, with a short intake form completed by whoever wants to use the supplier:

The answers set the supplier’s tier, and the tier sets the depth: the full questionnaire and an evidence review for critical suppliers, a short questionnaire and certificates for high-risk ones, and basic checks for the rest.

What should a supplier security questionnaire include?

A supplier security questionnaire should ask about the controls that would prevent or limit a breach of your data, with evidence for each answer. Use all twelve sections for critical suppliers and the first five for lower tiers.

The 14-day patch window mirrors the Cyber Essentials rule for high-risk and critical updates, so a certified supplier should already meet it. Accept recognised evidence in place of answers where you can: an ISO 27001 certificate with a relevant scope, or a SOC 2 Type II report, answers many questions at once.

What evidence should you ask suppliers for, and how do you check it?

Most problems show up in the dates and the scope:

Our Cyber Essentials certificate check guide explains each field of the IASME register.

How do I check a supplier is PCI compliant?

Ask for its current AOC for service providers and check it as above. The PCI Security Standards Council does not keep a register of compliant companies, so the AOC is the primary evidence. Visa and Mastercard each publish a list of registered service providers, which is a useful cross-check, but a compliant provider may not appear on either.

PCI DSS v4.0.1 Requirement 12.8 asks you to list your service providers (12.8.1), hold written agreements (12.8.2), carry out due diligence before engagement (12.8.3), monitor each provider’s compliance status at least every 12 months (12.8.4) and record which requirements each provider manages, which you manage and which are shared (12.8.5). Requirement 12.9 obliges providers to acknowledge their responsibilities in writing and give you that information. Our overview of PCI DSS Requirement 12 puts these in context, and the full text is in the PCI SSC document library. If you are the provider, see PCI DSS compliance for service providers.

What does a PCI DSS responsibility matrix look like?

The 12.8.5 record is usually a responsibility matrix. Our guide to PCI compliant hosting shows one for a hosting plan; this simplified example is for a managed IT provider with remote administrator access to systems in your cardholder data environment. The real split depends on the contract.

In a provider’s own matrix, check that shared items say which part each side does and that the services match those assessed on its AOC.

How do you score a vendor risk assessment and make a decision?

Rate each questionnaire section as meets, partly meets or does not meet, weighting the sections that matter most for that supplier, then record one of four decisions:

In ISO/IEC 27001:2022 the relevant Annex A controls are 5.19 to 5.23, covering supplier relationships, supplier agreements, the ICT supply chain, monitoring of supplier services and cloud services. Our ISO 27001 consultancy builds these controls into an ISMS.

How often should you reassess a supplier?

At least annually for critical suppliers, at renewal for the rest, and early after an incident, a change of ownership, a new subcontractor or new data. Evidence runs on its own clock too: each AOC every 12 months under PCI DSS 12.8.4, Cyber Essentials certificates every 12 months, and ISO 27001 certificates on a three-year cycle with surveillance audits in between. The NCSC’s supply chain security guidance sets out the principles behind it.

Why Sovereign Secure

This guide is for teams assessing their own suppliers. We help on both sides of the questionnaire: building supplier controls, and producing the evidence your own customers ask for.

• PCI DSS. As a PCI SSC Qualified Security Assessor (QSA) company we assess service providers whose customers need an AOC. We are also a Qualified PIN Assessor, a Card Production Security Assessor and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028.
• Cyber Essentials. As an IASME-licensed certification body we issue CE and CE+ certificates, which appear on the IASME register.
• ISO 27001. We are ISO 27001 certified ourselves. Certification audits are carried out by our partner certification body, MQA International.
• Testing. Penetration test reports and attestation letters that suppliers can share with customers. External ASV scans are delivered through a PCI SSC Approved Scanning Vendor partner.

Sovereign Secure Ltd was founded in 2012 and is headquartered in Accrington, Lancashire.

Need evidence for a customer’s questionnaire?

If a customer has asked you for an AOC, a Cyber Essentials certificate or a penetration test, or you are building supplier controls into an ISMS, send us an enquiry or call +44 161 523 5276.