Learn
The short answer
A vendor security questionnaire gathers what you cannot learn from a certificate: how a specific supplier handles your data, in their words, on the record. Late responses have three fixable causes: the form is too long for the supplier, it carries no deadline, and it reached the wrong person. Fix those three and response times change more than any amount of chasing will achieve.
On this page
- What a questionnaire is for, and what it is not
- Why questionnaires come back late
- Sizing the questionnaire to the supplier
- What to ask, and what to stop asking
- Sending one so it gets answered
- Chasing without doing it by hand
- Reading the answers critically
- The other side: answering them faster
- Do this in Venvera
- Frequently asked questions
What a questionnaire is for, and what it is not
A questionnaire is for the supplier-specific facts no certificate contains: which sub-processors they use for your service, where your data sits, who at their end holds access to it, how they would notify you of an incident, and what happens at exit.
It is not a substitute for evidence. Every answer is self-reported. Where a certification, a test report or a contract clause can tell you the same thing, that source is stronger, and asking for it in a questionnaire instead is how forms get long without getting more useful.
Why questionnaires come back late
The form is too long for the supplier. A three hundred question standard form sent to a four-person company is not going to be answered quickly, and much of it will be answered carelessly, which is worse than not asking.
There is no deadline. A request without a date is a request without a priority. It joins a queue behind everything that has one.
It reached the wrong person. Sent to an account manager who has to find someone technical, then someone in security, then legal. Every hop adds days.
Sizing the questionnaire to the supplier
| Supplier tier | Questionnaire | Why |
|---|---|---|
| Tier 1, critical function or sensitive data at scale | Full set, plus evidence requests and a call to walk through the answers | The depth is justified and the supplier expects it |
| Tier 2, material but replaceable | Short set focused on data handling, access, incident notification and sub-processors | Covers the questions that actually change your decision |
| Tier 3, low impact | A handful of questions, or none if a current certification covers it | The cost of asking exceeds the value of the answer |
The tiering that drives this comes from the assessment process itself, covered in how to perform a third-party risk assessment.
What to ask, and what to stop asking
Worth asking, because only they know: which sub-processors touch your data and where they are; where your data is stored and backed up; which of their staff can access it and under what controls; how and how quickly they would notify you of an incident affecting you; what happens to your data at termination; and whether the certification they hold actually covers the service you are buying.
Stop asking, because a document answers it better: whether they have a security policy (ask for the certification scope instead), whether they run penetration tests (ask for the summary), and anything already fixed in the contract. Every question you remove increases the chance the rest are answered properly.
Sending one so it gets answered
- Name the recipient. Ask your business owner who the supplier's security contact is before you send anything.
- Put a date in the first line. Two weeks is reasonable for a short form and rarely disputed.
- Say why you are asking and what happens next. Suppliers respond faster when the request is tied to a decision that affects them.
- Send the short form first. Escalate to the full set only if the answers surface something.
- Make responding easy. A link beats an attachment. If they can start, save and finish, they will.
Chasing without doing it by hand
Chasing is the single largest time cost in a third-party programme, and it is entirely mechanical: notice a response is outstanding, work out how long, send a reminder, escalate to the business owner, repeat. None of that requires judgement, which makes it the obvious thing to automate.
What a good chase sequence looks like: a reminder a few days before the deadline, one on the day, one after, and then escalation to the internal business owner rather than another message to the supplier. The internal escalation is the one that works, because the business owner wants the supplier onboarded.
Reading the answers critically
- Check certification scope, not just existence. A certificate covering a different legal entity or a different product is common.
- Watch for answers that describe an intention. "We are implementing MFA" is a gap with better grammar.
- Compare the sub-processor list against your other suppliers. This is where concentration you did not know about turns up.
- Take the incident notification answer seriously. If they will not commit to a timeframe, your own regulatory clocks are exposed.
- Note what they did not answer. A blank is information.
The other side: answering them faster
If you receive questionnaires as well as sending them, the same overlap works in your favour. Most buyer questions repeat, so publishing your posture and your standard answers once removes most of the work. That is what a trust center is for, and it is usually the difference between a security review adding days to a deal and adding hours.
Do this in Venvera
Venvera runs questionnaire campaigns against your supplier register, tracks who has responded and who has not, chases automatically, and feeds the answers into the provider's risk score alongside contract and concentration data. Campaigns are unmetered on Professional and Enterprise, so questionnaire volume never becomes a reason to skip a supplier. See third-party risk management, or the free vendor risk assessment template to start from a spreadsheet.
Send your first campaign with us
Book 30 minutes. We will size a questionnaire to your supplier tiers, set up the chase sequence, and send the first campaign on the call.
Book a walkthroughFrequently asked questions
What is a vendor security questionnaire?
A set of questions sent to a supplier to establish how they handle your data and access: sub-processors, data location, staff access, incident notification, and what happens at exit. It gathers the supplier-specific facts a certification cannot tell you.
How long should a vendor security questionnaire be?
As long as the supplier's tier justifies. A full set for a supplier supporting a critical function, a short set focused on data handling and incident notification for a material one, and a handful of questions or none for low-impact suppliers already covered by a current certification.
How do I get vendors to respond faster?
Address it to a named security contact rather than an account manager, put a deadline in the first line, explain what decision it feeds, send the short form first, and use a link rather than an attachment. Then automate the reminders and escalate internally to the business owner rather than sending a fourth message to the supplier.
Is a questionnaire enough on its own?
No. Answers are self-reported. Read the certification scope statement, request test summaries, and check the contract. Where a document can answer a question, the document is the stronger source.
What should I look for in the answers?
Certification scope rather than existence, answers that describe intentions rather than current state, sub-processors that overlap with your other suppliers, a concrete incident notification timeframe, and any question left blank.
How often should questionnaires be re-sent?
On the assessment cycle for the tier, and out of cycle when the supplier is acquired, has an incident, changes sub-processors or hosting, or materially changes what it does for you.
How do we answer questionnaires faster ourselves?
Publish your posture and standard answers once through a trust page, with the sensitive documents released under access control. Most buyer questionnaires overlap heavily, so answering once and sharing a link resolves the majority of reviews.
