Third-Party Risk

Vendor Risk Assessment Questionnaire

68 structured security questions across 9 domains - with Yes/No/NA + evidence columns, subcontractor (4th-party) risk section, and a Low/Medium/High risk scoring rubric.

Buy Now - $47 Browse All Templates

✓ Instant download

✓ Editable .docx

✓ 30-day money-back guarantee

✓ Written by CISSP & CCSP

What You Get

What's Inside

Everything is included - no hidden extras, no consulting required.

✓68 assessment questions across 9 security domains
✓Yes / No / NA response columns plus evidence description column
✓Security Governance, Access Control, and Endpoint & Network Security domains
✓Data Security & Privacy, Incident Response, and Business Continuity domains
✓Vulnerability Management, Third-Party / Subcontractor Risk, and Compliance domains
✓Risk scoring rubric (Low / Medium / High) with aggregate vendor risk rating
✓Subcontractor and 4th-party risk assessment section
✓Assessor approval workflow and sign-off section

Ideal For

Who This Is For

Whether you're building from scratch or formalizing what's already in place.

Procurement & Vendor Teams

Evaluating new vendor security posture before contract execution with a structured, repeatable process

CISOs & Risk Officers

Running a formal third-party risk program with documented, auditable vendor assessments

MSPs & IT Consultants

Helping clients assess and onboard vendors with a professional questionnaire

Common Questions

Frequently Asked Questions

Everything you need to know before you buy.

How many questions are included?

68 questions organized across 9 security domains, from governance and access control to business continuity and compliance.

Does this cover 4th-party (subcontractor) risk?

Yes. There is a dedicated section for subcontractor risk, asking vendors how they manage the security of their own supply chain.

Can I customize the questions?

Yes. The questionnaire is an editable .docx file - add, remove, or modify questions to match your organization's requirements.

What frameworks does this map to?

Questions reference common standards including SOC 2, ISO 27001, NIST CSF, and CIS Controls. It is designed to be framework-agnostic and applicable to any vendor relationship.

How does the risk scoring work?

Each domain gets a Low/Medium/High rating based on responses. The rubric aggregates domain scores into an overall vendor risk rating to guide your follow-up due diligence.

Stop Starting From a Blank Page