Third-party cybersecurity questionnaire templates have a reputation problem. Most are inherited spreadsheets — 180 rows copied from somebody else’s compliance programme, sent to every supplier regardless of what that supplier actually touches, answered with a column of unverified ticks, and filed. The exercise looks like assurance. It produces almost none.
That matters more than it used to. Verizon’s Data Breach Investigations Report found third-party involvement in breaches doubled year on year, from roughly 15% to 30% of cases, and the UK Government’s Cyber Security Breaches Survey has consistently found that only a small minority of businesses formally review the risks posed by their immediate suppliers. Meanwhile the contracts landing on your desk — from enterprise customers, from insurers, from anyone touching regulated data — increasingly demand evidence that you assess your own supply chain. Good vendor management is no longer a procurement nicety.
This guide gives you a working third-party cybersecurity questionnaire template: the eight domains it should cover, the exact questions inside each one, a tiering model so you stop sending 180 rows to the company that prints your letterheads, a scoring rubric that produces a decision rather than a number, the evidence to demand instead of trusting ticks, and the contract clauses that make the answers binding. Everything below is designed to be copied straight into your own programme, and to stand up later as proof that supply chain cybersecurity was genuinely assessed.
Table of contents
- Why a Third-Party Cybersecurity Questionnaire Is Your Only Real Control
- What Belongs in a Third-Party Cybersecurity Questionnaire Template
- Tier Your Suppliers Before You Send Anything
- The Full Third-Party Cybersecurity Questionnaire Template
- Scoring Answers Without Turning It Into Theatre
- Evidence Beats Ticks Every Single Time
- Red Flags in a Third-Party Cybersecurity Questionnaire Response
- Mapping the Questionnaire to Cyber Essentials, ISO 27001 and NIS2
- Sending, Chasing and Closing the Loop
- Common Mistakes That Waste a Third-Party Cybersecurity Questionnaire
- Building the Questionnaire Into Contracts and Renewals
- Frequently Asked Questions
- References
Why a Third-Party Cybersecurity Questionnaire Is Your Only Real Control
Supplier cybersecurity is the one area where your own controls simply run out. You cannot patch a supplier’s servers. You cannot enforce MFA on their admin accounts, review their firewall rules, or sit in on their incident calls. Once you hand over data, network access, or a software dependency, your direct technical control ends. What remains is contractual and informational — and the third-party cybersecurity questionnaire is the instrument that gathers the information half.
The attack path runs through the weakest connected party
Attackers have worked out that the fastest route into a well-defended organisation is a poorly defended one that already has legitimate access. That access might be a VPN account for a maintenance contractor, an API key held by an integration partner, a managed service provider’s remote tooling, or an npm package three dependencies deep. None of these show up in your own vulnerability assessment, because none of them are your assets.
Regulators now treat supplier failure as your failure
Under UK GDPR, a controller must only use processors providing sufficient guarantees of appropriate technical and organisational measures — the assessment is your obligation, not the processor’s. NIS2 pushes the same logic across the EU through Article 21. The Cyber Assessment Framework expects the same of essential services. A third-party cybersecurity questionnaire, properly retained, is the artefact that demonstrates you actually made that assessment.
The questionnaire is also a negotiating position
Sending a serious third-party cybersecurity questionnaire changes the conversation before a contract is signed. Gaps found pre-signature become remediation commitments with dates. Gaps found post-signature become disputes. The template below is deliberately structured so its output maps onto contract schedules.
What Belongs in a Third-Party Cybersecurity Questionnaire Template
A usable third-party cybersecurity questionnaire covers eight domains. Fewer and you miss whole categories of exposure; more and response rates collapse. Each domain below carries a target question count for a full Tier 1 review.
| Domain | What it establishes | Questions |
|---|---|---|
| Governance and certification | Who owns security, and what independent assurance exists | 6 |
| Access control and identity | How accounts are issued, protected and revoked | 8 |
| Data handling and location | What they hold, where it sits, how long they keep it | 7 |
| Infrastructure and patching | Whether known vulnerabilities get fixed on a clock | 6 |
| Secure development | Whether code reaching you was reviewed and tested | 6 |
| Incident response and notification | How fast you hear, and from whom | 5 |
| Business continuity and backup | Whether they can come back, and how quickly | 5 |
| Their own subcontractors | Who else is in the chain behind them | 4 |
Keep every question answerable and checkable
The single biggest defect in an inherited third-party cybersecurity questionnaire is the unanswerable question. “Describe your security posture” produces marketing copy. “Is MFA enforced on all administrative accounts, and can you supply a screenshot of the enforcement policy?” produces either evidence or a revealing silence. Every question in the template that follows is binary or short-answer, and every one has a defined evidence artefact attached.
Tier Your Suppliers Before You Send Anything
Sending the full third-party cybersecurity questionnaire to all 200 suppliers is the fastest way to kill the programme. Response rates fall, your team drowns in low-value returns, and the suppliers that genuinely matter get the same attention as the coffee company. Tier first.
The three-question tiering test
Tiering decides who receives the full third-party cybersecurity questionnaire and who receives a short attestation. Ask three things about each supplier: do they hold or process personal or commercially sensitive data; do they have network, system, or administrative access to your environment; and would a 48-hour outage on their side stop you trading. One yes puts a supplier in Tier 2. Two or more puts them in Tier 1.
| Tier | Typical supplier | Questionnaire depth | Evidence | Re-assessed |
|---|---|---|---|---|
| Tier 1 — critical | MSP, hosting, payroll, core SaaS | Full 47 questions | Certificates, reports, policy extracts | Annually |
| Tier 2 — important | Marketing tools, CRM add-ons, contractors | Short-form 18 questions | Certification only | Every 2 years |
| Tier 3 — low touch | Stationery, facilities, print | Attestation, 5 questions | Self-declaration | On renewal |
Re-tier when the relationship changes
Tiering is not permanent. A Tier 3 supplier that is granted a system integration becomes Tier 1 the day the API key is issued. Build the tiering question into your procurement intake so the third-party cybersecurity questionnaire is triggered automatically rather than remembered.
The Full Third-Party Cybersecurity Questionnaire Template
What follows is the Tier 1 question set — the full third-party cybersecurity questionnaire, 47 questions across the eight domains. Tier 2 uses the questions marked as core. Copy them verbatim; the phrasing is deliberately closed so answers can be scored without interpretation.
Domain 1 — Governance and certification
Who is the named individual accountable for information security? Do you hold Cyber Essentials, Cyber Essentials Plus, ISO 27001, or SOC 2 Type II, and what is the certificate expiry date? What is the scope statement on that certificate? When was your last independent security assessment, and by whom? Do you carry cyber insurance, and at what limit? Has your organisation suffered a reportable breach in the last 24 months?
Domain 2 — Access control and identity
Is multi-factor authentication enforced on all administrative and remote-access accounts? How are accounts provisioned and, critically, deprovisioned when staff leave? Is there a documented joiners-movers-leavers process with a target revocation time? Are privileged accounts separate from day-to-day accounts? Do any shared or generic accounts exist? How is access to our data or systems specifically restricted? Are third-party remote-access sessions logged? How often is access reviewed and recertified?
Domain 3 — Data handling and location
Precisely what categories of our data will you hold or process? In which countries is that data stored, processed, and backed up? Is data encrypted at rest and in transit, and with what algorithms? What is your retention period, and what is the documented deletion process at contract end? Who internally can access our data, and how many people is that? Is our data logically or physically separated from other clients’ data? Will you use our data for any secondary purpose, including training machine learning models?
Domain 4 — Infrastructure and patching
What is your target time to patch critical vulnerabilities, and what was your actual median last quarter? How do you discover vulnerabilities — scanning, feeds, or penetration testing? Are all supported systems within vendor support windows? Is endpoint protection deployed and centrally monitored? Are security logs retained, and for how long? Do you operate any end-of-life systems in the service we buy?
Domain 5 — Secure development
Do developers receive secure coding training, and how often? Is code peer-reviewed before merge? Do you run static and dependency scanning in the pipeline? How are secrets managed — vault, environment variables, or repository? What is your process for handling a vulnerability disclosed in a dependency? Do you maintain a software bill of materials for the product we consume?
Domain 6 — Incident response and notification
Do you have a documented and tested incident response plan? Within how many hours will you notify us of an incident affecting our data or service? Who is the named contact, and is there an out-of-hours route? Will you support our own regulatory notification obligations with evidence? When did you last run an incident exercise, and what changed as a result?
Domain 7 — Business continuity and backup
What are your documented recovery time and recovery point objectives for the service we buy? When were backups last restored as a test, not merely verified? Are backups held immutably or offline? Where is your continuity plan documented, and when was it last exercised? What happens to our service if your primary site or region is unavailable?
Domain 8 — Their own subcontractors
Which subcontractors are involved in delivering our service, and what do they access? Do you apply a third-party cybersecurity questionnaire to them, and at what depth? Will you notify us before adding or changing a material subprocessor? Do your subcontractor contracts flow down the same security obligations you accept with us?
Scoring Answers Without Turning It Into Theatre
A third-party cybersecurity questionnaire that produces a percentage is worse than one that produces nothing, because a percentage invites people to stop thinking. Score for decisions instead.
Use four outcomes, not a number
Every answer resolves to one of four states: Met (answered and evidenced), Partially met (answered, evidence weak or absent), Not met (control absent), or Not applicable. The supplier’s overall outcome is then driven by rules rather than arithmetic — for example, any Tier 1 supplier with a Not met on MFA, backup testing, or breach notification cannot be approved regardless of how the rest of the third-party cybersecurity questionnaire scored.
| Outcome | Trigger | Action | Owner |
|---|---|---|---|
| Approved | No Not met on any critical control | Proceed, diarise re-assessment | Procurement |
| Approved with conditions | Partially met on non-critical controls | Remediation plan with dates in contract | Security lead |
| Escalate | Not met on a critical control | Risk acceptance signed at director level | Risk owner |
| Declined | Refusal to answer, or evidence contradicts answers | Do not onboard | Security lead |
Weight the critical controls explicitly
Name your critical controls in the template itself, before you send it. For most organisations they are MFA on privileged access, tested backups, a breach notification window, deprovisioning within 24 hours, and encryption of data at rest. Everything else informs the conversation; these five decide it.
Evidence Beats Ticks Every Single Time
The gap between what suppliers claim in a third-party cybersecurity questionnaire and what they can evidence is the entire value of running one properly. Asking for the artefact costs one extra sentence per question and changes the result completely.
Across a typical review cycle the pattern is consistent: the more operationally demanding the control, the wider the gap between claim and proof.
The evidence list for each domain
Attach a required artefact to every domain of the third-party cybersecurity questionnaire. Governance wants the certificate PDF plus its scope statement, not a logo on a website. Access control wants a screenshot of the MFA enforcement policy and a redacted sample of a leaver ticket showing the revocation timestamp. Patching wants an extract from the scanner showing median remediation time. Continuity wants the date and outcome of the last restore test. Incident response wants the exercise report. Each artefact takes a supplier minutes to produce if the control exists, and is impossible to produce if it does not.
Accept independent assurance as a shortcut
If a supplier holds ISO 27001 or SOC 2 Type II covering the service you buy, accept the report in place of the corresponding domains and review only the scope, exceptions, and complementary user entity controls. That is what an ISO 27001 readiness assessment exists to produce, and refusing to accept it wastes goodwill you will need later.
Red Flags in a Third-Party Cybersecurity Questionnaire Response
Some answers are worse than a straightforward “no”. Train whoever reviews returns to spot these, because they are the difference between a filed document and an actual finding.
| Red flag | What it usually means | Your move |
|---|---|---|
| Every answer is “Yes” | Sales completed it, not engineering | Request evidence on five random controls |
| Certificate scope excludes your service | Certification is real but irrelevant | Ask for the scope statement in writing |
| “Industry standard” with no specifics | Control is undefined or absent | Re-ask as a closed question |
| No named security owner | Nobody is accountable day to day | Require a name in the contract |
| Notification window over 72 hours | You will breach your own obligations | Negotiate to 24 hours, non-negotiable |
| Subcontractors “commercially confidential” | Chain visibility ends here | Require disclosure under NDA or decline |
Silence is itself an answer
A supplier who will not complete a third-party cybersecurity questionnaire for a contract of meaningful size is telling you something specific. Record the refusal, escalate it as a risk acceptance, and make sure the person signing that acceptance is senior enough to own the consequence.
Mapping the Questionnaire to Cyber Essentials, ISO 27001 and NIS2
You will save enormous amounts of time by mapping each domain to the frameworks your customers and regulators already recognise. It lets suppliers answer once, and it lets you point at a standard rather than argue about your house rules.
| Domain | Cyber Essentials | ISO 27001:2022 | NIS2 Article 21 |
|---|---|---|---|
| Access control | User access control | A.5.15 – A.5.18 | Access control policies |
| Patching | Security update management | A.8.8 | Vulnerability handling |
| Malware and endpoints | Malware protection | A.8.7 | Basic cyber hygiene |
| Incident response | Not covered | A.5.24 – A.5.27 | Incident handling |
| Continuity and backup | Not covered | A.5.29, A.8.13 | Business continuity |
| Subcontractors | Not covered | A.5.19 – A.5.22 | Supply chain security |
Cyber Essentials is a floor, not a ceiling
Cyber Essentials covers five technical controls well and says nothing about incident response, continuity, or subcontractors. It is an excellent minimum bar for Tier 2 suppliers and a poor substitute for a Tier 1 third-party cybersecurity questionnaire. Our guide to Cyber Essentials for suppliers covers how to word that requirement in a contract.
Watch the regulatory pull-through
If your customers are subject to NIS2 compliance, their supply chain obligations arrive on your desk as contract clauses, and yours arrive on your suppliers’ desks the same way. Aligning the third-party cybersecurity questionnaire to Article 21 now saves a rewrite later.
Sending, Chasing and Closing the Loop
Most programmes fail in logistics rather than content. A third-party cybersecurity questionnaire that sits unanswered for eleven weeks has cost you effort and bought you nothing.
Give it a deadline and a consequence
Issue the third-party cybersecurity questionnaire with a hard return date: ten working days, stated in the covering email, with the consequence spelled out: onboarding does not proceed and invoices are not raised against a new contract until the return is complete. Vague deadlines produce vague timelines.
Close the loop in writing
Every completed third-party cybersecurity questionnaire ends with a short outcome letter to the supplier: the decision, any conditions, the remediation dates agreed, and the re-assessment date. That letter is what turns a filed spreadsheet into an auditable control, and it is the document your insurer or regulator will ask to see.
Keep a live register
One register, one row per supplier: tier, date assessed, outcome, critical control exceptions, remediation due dates, re-assessment date, and named internal owner. If your third-party cybersecurity questionnaire results live in individual inboxes, you do not have a programme.
Common Mistakes That Waste a Third-Party Cybersecurity Questionnaire
Sending the same depth to everyone
Covered above, but it is the most common failure by a distance. Depth should follow risk, or nobody takes the exercise seriously.
Never reading the answers
Sounds absurd; happens constantly. A returned third-party cybersecurity questionnaire that is filed unread is worse than none, because it creates a documented false assurance that will be produced against you after an incident.
Asking for controls you do not have yourself
Suppliers notice. If your own IT security posture cannot answer a question, either fix it or drop the question — asymmetric demands erode the credibility of the whole programme.
Treating it as a one-off
Assurance decays. Staff leave, certificates lapse, architectures change, and the supplier you assessed in 2024 may have been acquired twice since. Annual re-assessment for Tier 1 is the minimum, plus an event-driven trigger on acquisition, breach, or material service change.
Ignoring the fourth party
Your supplier’s supplier can end your service just as effectively. Domain 8 exists for exactly this, and it is the domain most often deleted to shorten the form.
Building the Questionnaire Into Contracts and Renewals
A third-party cybersecurity questionnaire has no teeth until its answers become obligations. The cheapest moment to do this is the fortnight before signature, when the supplier still wants the deal.
Attach the completed return as a schedule
Do not summarise it. Attach the actual completed third-party cybersecurity questionnaire as a numbered schedule so there is no argument later about what was represented.
Bind the notification window
Twenty-four hours to notify you of an incident affecting your data, with a named contact and an out-of-hours route. Anything longer and your own incident response obligations become impossible to meet.
Reserve an audit and exit right
A right to request evidence, a right to re-assess on material change, and a defined exit process covering data return and deletion with a certificate of destruction. These three rights are what make the questionnaire enforceable rather than decorative.
Frequently Asked Questions
How long should a third-party cybersecurity questionnaire be?
A Tier 1 third-party cybersecurity questionnaire runs to around 45 to 50 questions, 18 for Tier 2, and 5 for Tier 3. Longer sets do not produce better assurance; they produce lower response rates and more copy-paste answers.
Can we just accept a supplier’s ISO 27001 certificate?
For the domains it covers, yes — provided you read the scope statement and confirm the service you buy is inside it. Certification does not cover notification windows, subcontractor disclosure, or your specific data location requirements, so those questions still need asking.
Who should complete the questionnaire on our side?
Procurement should own the process and the register; a security lead should own the scoring and the critical-control decisions. Splitting it this way stops the third-party cybersecurity questionnaire from becoming a security team bottleneck.
How often should suppliers be re-assessed?
Annually for Tier 1, every two years for Tier 2, and at renewal for Tier 3 — with an immediate re-assessment triggered by a breach, an acquisition, or a material change to the service.
Do small businesses really need this?
Yes, and usually more urgently, because small businesses concentrate more risk in fewer suppliers. A five-question attestation for most suppliers plus a full third-party cybersecurity questionnaire for the three that matter is a proportionate programme that takes days, not months, to stand up.
What if a supplier refuses to answer?
Treat refusal as a finding rather than an obstacle. Document it, price the risk, and have a director sign the acceptance. In practice, a written escalation resolves most refusals within a fortnight.
References
NCSC — Supply Chain Security Guidance
NCSC — Cyber Essentials Overview
NCSC — Risk Management Collection
NCSC — Cyber Assessment Framework
NIST SP 800-161 Rev. 1 — Cybersecurity Supply Chain Risk Management Practices
Cloud Security Alliance — Cloud Controls Matrix and CAIQ
Verizon Data Breach Investigations Report
UK Government — Cyber Security Breaches Survey
