Third-Party Security Questionnaires: Getting Evidence, Not Ticks

Many security breaches begin with a supplier. A software provider is compromised, a service company's access is misused, a cloud platform is misconfigured, and the impact lands on its customers. As organisations rely on more suppliers for more critical services, third-party risk has become one of the main concerns for security teams.

The standard response is a security questionnaire. Suppliers receive a spreadsheet of a few hundred questions, answer "yes" to most of them, and return it. The questionnaire is filed, the supplier is approved, and nobody looks at it again until renewal. Both sides spend a great deal of time, and neither learns much.

This article sets out how to make third-party security assessment genuinely useful.

Why traditional questionnaires fall short

• They are generic. The same long questionnaire goes to a catering company and a payroll provider.
• Answers are self-reported. "Do you encrypt sensitive data?" invites a yes, whatever the reality.
• They are point-in-time. A supplier's security can change significantly between annual reviews.
• They are burdensome. Suppliers receive dozens of different questionnaires from different customers and fill them in as quickly as possible.
• They are rarely acted on. Gaps identified in responses often go unaddressed because nobody owns the follow-up.

Step 1: Tier your suppliers

Not every supplier deserves the same scrutiny. Start by tiering suppliers by the risk they bring:

• What data do they access? Personal, financial or commercially sensitive data raises the tier.
• What systems do they connect to? Direct network or administrative access raises it further.
• How critical is the service? Could a failure or compromise stop key operations?
• How replaceable are they? Hard-to-replace suppliers need more attention.

A simple three-tier model works well. Low-risk suppliers might complete a short set of questions. High-risk suppliers receive a thorough assessment and ongoing monitoring.

Step 2: Ask fewer, better questions

Long questionnaires produce long, unhelpful answers. Focus on the controls that matter most for the risk in question. For most suppliers handling your data, those include:

• Multi-factor authentication for administrative and remote access.
• How quickly critical vulnerabilities are patched.
• Backups, and whether they are protected against ransomware.
• Logging and monitoring of access to your data.
• Incident response, including how quickly they will notify you.
• How they manage their own suppliers.
• Where your data is stored and who can access it.

A focused set of twenty to forty questions, tailored to the tier, usually produces better information than three hundred generic ones.

Step 3: Ask for evidence, not assertions

For higher-risk suppliers, replace "Do you...?" questions with requests for evidence:

• Independent reports and certifications, such as SOC 2 reports or ISO/IEC 27001 certificates, checked for scope (does it cover the service you are buying?) and currency.
• Recent penetration test summaries, including how findings were addressed.
• Policies and procedures for the most important controls.
• Examples of operation, such as evidence of recent backup restore tests or access reviews.

Read the evidence. A SOC 2 report contains exceptions and complementary controls that you, as the customer, are expected to operate. Those details matter.

Step 4: Use standard questionnaires where you can

Industry-standard questionnaires, such as the Standardized Information Gathering (SIG) questionnaire and others used in specific sectors, reduce the burden on suppliers, who can reuse answers. Accepting a recent standard response, plus a few questions specific to your situation, is often better for everyone than insisting on your own format.

Step 5: Act on what you find

An assessment only reduces risk if gaps lead to action:

• Agree remediation for significant gaps, with deadlines.
• Use contracts. Security requirements, breach notification timeframes and audit rights should be in the contract, not just the questionnaire.
• Accept risk deliberately. Where a gap cannot be fixed, record a decision by someone with the authority to accept the risk, ideally with compensating controls.
• Track it. Follow up before the next review.

Step 6: Monitor between reviews

Annual questionnaires miss what happens in between. For critical suppliers, add ongoing signals:

• External security ratings or attack surface monitoring.
• News and breach notifications involving the supplier.
• Changes in ownership, financial health or key services.
• Contractual obligations to notify you of significant incidents or changes.

Step 7: Manage access, not just paperwork

Some of the most effective third-party controls sit on your side: limiting supplier access to what is needed, using individual accounts with multi-factor authentication, logging what suppliers do in your systems, and removing access promptly when engagements end.

Third-party security and vendor management

Security assessment works best as part of a wider supplier management process, where each significant supplier has an owner who tracks performance, risk and changes throughout the relationship. Security teams cannot manage every supplier alone; business owners need to know when to involve them.

The Third-Party Security assessment covers vendor risk assessment, continuous monitoring, SaaS and cloud governance, fourth-party and concentration risk, contractual security and access control, and third-party incident response. The Vendor & Supply Chain Management assessment looks at how supplier relationships are run more broadly.

Frequently asked questions

How often should we reassess suppliers?

High-risk suppliers typically annually, with continuous monitoring in between. Lower-risk suppliers can be reassessed less often, or when the service or data involved changes.

Is a SOC 2 report enough?

It is valuable independent evidence, but check that its scope covers the service you use, read any exceptions, and make sure you operate the controls it expects of customers. It does not replace contractual protections or ongoing monitoring.

What about suppliers that refuse to complete questionnaires?

Large providers often decline custom questionnaires but publish standard evidence, such as certifications and audit reports. Review that evidence instead. If a supplier offers no evidence at all for a high-risk service, treat that as a significant risk in itself.