A security assessment questionnaire sets out questions a firm sends to a vendor. It then scores each reply on the evidence the vendor sends back. This one is for IT managers, security leads and owners at firms of roughly 250 to 2,000 people in India or the GCC. They are about to let a supplier sign in to their systems or hold their data. The questionnaire has 15 questions in five groups, five of them marked as gates, and the access questions come first. It offers no file, so copy the tables into your own sheet. It is also not a contract review, a risk list or a build guide for your own access controls.
Last reviewed 2026-11-02 by Manish Sharma.
Key Takeaway – Mark a reply you have not opened as Told, not Shown. – Read the five gate questions before you read the total. – A refusal is a result: mark it Blank and write down why.
Marking the Replies to This Security Assessment Questionnaire
Marking each reply to the security assessment questionnaire takes three steps: pick a depth, apply one of three marks, and read the gates first. The firm marks each reply, while the vendor only supplies the evidence.
Choosing the Depth for Each Vendor
When you pick a depth, start from what the vendor can reach. Depth A fits a vendor that reaches one system and holds none of your data: the five gate questions, worth 10 points. If the vendor reaches several systems or holds any of your data, use depth B. That is the five gates plus questions 4, 5, 6, 7, 9 and 12, 11 in all, worth 22 points. Choose depth C when the vendor has admin rights or sensitive data: all 15 questions, adding 10, 13, 14 and 15, worth 30 points. The three depths and their limits are Signisys’ own, but one NCSC idea sits behind them. The NCSC’s Assessing supply chain security page addresses large organisations, the public sector and cyber security professionals. It lists a one-size-fits-all approach for every supplier as poor practice. The depths are our way of acting on that idea.
The Three Marks, Gates and Sample Rule
- Shown (2): the vendor sent a record you opened, and its name, date and scope fit the question.
- Told (1): a clear written answer with no record, or a record that is out of date or covers something else.
- Blank (0): no reply, a refusal, or an answer to a different question.
When a question asks for a record about a person, you pick the person. Ask for the record of someone you choose from the vendor’s list, not someone the vendor selects. If a question falls outside the depth, you skip it, and its points stay out of the top total. If a question does not fit this vendor, it is N/A and does the same. A refusal, though, is not N/A.
A gate question is one that decides whether the rest is worth reading. Gates carry a (G). A Told or Blank on a gate goes to a named person to decide, whatever the total.
For example, on question 2 the vendor writes that staff lose access when they leave. That scores Told, 1, because the vendor sent no record. When you ask for the closing record of one leaver you name, it comes back as a dated ticket. The ticket shows that person’s account to your systems removed. That scores Shown, 2, because you opened a record that fits the question. This example is illustrative, not a client.
The questionnaire sets no target total or band, and the marks give nothing to base one on. The marks, gates and depths are Signisys’ method, and no standard sets them.
Security Assessment Questionnaire, Part 1: Access Into Your Systems
The first five questions of the security assessment questionnaire ask about the vendor’s side of access. They cover its people, its leavers, its sign-in, its devices and its reviews. They also do not test your own identity and access management controls.
Questions 1 to 3: People, Leavers and Sign-In
| No. | Question to send | Evidence to ask for | Reads as |
|---|---|---|---|
| 1 (G) | Which of your staff will sign in to our systems, and does each use their own account? | A list of roles or names, plus the approval record for one person we pick. | Shown if the record names that person and carries a date; Told if the reply is a policy statement only. |
| 2 (G) | When someone on your staff who has access to us leaves or changes team, how is that access ended, and how do you tell us? | The written steps, plus the closing record of one leaver we name. | Shown if the record shows that person’s access to us removed, with a date; Told if the steps exist but no record does. |
| 3 (G) | Does every account your staff use to reach us need a second check at sign-in? | A dated policy extract, or a screen-share of the setting. | Shown if you see the setting on an account we name; Told if the answer is yes and you see nothing. |
These three questions are Signisys’ own checks, while multi-factor sign-in explains the second check in question 3.
Questions 4 and 5: Devices, Tools and Review
| No. | Question to send | Evidence to ask for | Reads as |
|---|---|---|---|
| 4 | Which devices, remote-support tools and file-sharing tools do your staff use to reach us, and who manages them? | A list of the tools, plus the rule for devices. | Shown if the reply names each tool and its manager; Told if “managed devices” is the whole reply. |
| 5 | When did you last check which of your staff still need access to client systems? | The record of that check, with a date. | Shown if the record carries a date and names what changed; Told if the reply describes a review with no date. |
Questions 4 and 5 are also Signisys’ own checks.
Security Assessment Questionnaire, Part 2: Data, Incidents and Staff
Part 2 of the security assessment questionnaire moves from logins to what the vendor does with your data. The questions also cover who you call when something goes wrong and how the vendor screens staff. It uses two blocks, so each table stays short.
Questions 6 and 7: Data
| No. | Question to send | Evidence to ask for | Reads as |
|---|---|---|---|
| 6 | Which of our data will you store or copy, and where, including email, personal devices and online tools? | A written data list with locations. | Shown if the reply names each place; Told if it gives only “secure storage”. |
| 7 | What happens to our data and your access when the work ends? | The written end-of-work steps, plus a sample deletion confirmation with client names hidden. | Shown if both come; Told if only the steps do. |
Question 7 is our own check, while question 6 draws on NCSC’s idea of knowing what data each supplier holds.
Question 7 asks for a sample deletion confirmation with client names hidden, and question 10 asks for the date of the latest training record without names.
Questions 8 to 10: Who to Call, Telling a Client and Staff
| No. | Question to send | Evidence to ask for | Reads as |
|---|---|---|---|
| 8 (G) | Who do we call at your end if you suspect a problem touching our access or data, and how will you reach us? | A named role and route, in writing. | Shown if the reply gives a role, a way to reach it outside office hours and the document’s date; Told if “contact support” is the reply. |
| 9 | How do you decide when to tell a client, and when was that route last tried? | The written rule, plus the date of the last test or exercise. | Shown if both come; Told if the rule has no test date. You record the vendor’s own timing, and the article sets none. |
| 10 | How are staff with access to our systems screened and trained? | The screening rule, plus the date of the latest training record, without names. | Shown if both carry dates; Told if the reply describes only a policy. |
Questions 8 to 10 are Signisys’ own checks, while incident response covers the wider process behind question 8.
Security Assessment Questionnaire, Part 3: The Vendor’s Own Suppliers
In this part of the security assessment questionnaire, the vendor may not be the only company that touches your data. The NCSC page named earlier treats knowing sub-contractors, and requiring protections to pass down the chain, as good practice. If one of those companies has a weakness, that weakness is the kind of route a supply chain attack uses.
| No. | Question to send | Evidence to ask for | Reads as |
|---|---|---|---|
| 11 (G) | Which other companies will touch our data or our systems while you do this work? | A list of company names, with what each does for us. | Shown if every name has a task beside it; Told if “some partners” is the reply. |
| 12 | How do you pass your security requirements to those companies, and how do you check they follow them? | A clause extract, plus the latest check record. | Shown if both exist and name those companies; Told if the reply describes a clause without a check. |
| 13 | Will you tell us before you add or change one of them? | The written commitment, or the clause that holds it. | Shown if it is in writing and dated; Told if you get only a spoken or emailed assurance with no document. |
Question 13 is our own check. Questions 11 and 12 draw on NCSC’s ideas of knowing the full extent of the chain and of passing protections down and checking. The questions and marks are ours.
If a vendor will not name its suppliers, this group stays at Blank, and the Blank is the result.
Reading a Certificate or Report in a Security Assessment Questionnaire
A certificate speaks only for the scope it names, and that scope may be narrower than the vendor. Read four things on the page before you score. This section is Signisys’ reasoning, not NCSC’s and not a standard’s. It states only what is true of a certificate or report on its face. That means who issued it, what it covers and what dates it carries.
Four Things to Read on a Vendor’s Certificate or Report
Key Takeaway Read the scope and the dates on a certificate before you score it.
Questions 14 and 15: Assurance
Independent assurance means a check made by someone outside the vendor.
| No. | Question to send | Evidence to ask for | Reads as |
|---|---|---|---|
| 14 | Which independent certificate or audit report covers the service you give us? | The certificate or the scope page, with its dates. | Shown if the four reads fit your service; Told if a certificate exists but its scope or date does not fit; Blank if only a logo or badge comes. |
| 15 | When was the last independent technical test of the systems we will use, and what happened to its findings? | A summary with its date and scope, plus a record of fixes. | Shown if the summary covers those systems and the record shows fixes; Told if the reply describes a test without a document. |
Question 14 is our own reasoning. Question 15 draws on NCSC’s listing of audits and penetration testing as independent views, while the marks are ours.
NCSC also names Cyber Essentials Plus as an example of independent assurance. This article names it only as NCSC’s example. Written answers count as self-reported until you attach a record, and a certificate is another party’s statement about the scope it names.
What to Do When a Vendor’s Reply Is Late, Thin or Refused
Treat it as a result and work through it in order.
Write which question and which record is missing, in one sentence.
Send one written request, not a second questionnaire.
If a vendor will not send documents, it may show a record on a call. It can earn Shown if you note the date, name and scope as you see them.
A refusal, no reply or a brochure scores Blank. Write the reason beside the mark.
For a gate question, the owner decides. The options are narrower access, a shorter term, a check on your own side or not going ahead. These are decisions for a named person, and this article recommends none.
The NCSC page describes good practice as an audit request not being your first interaction with a supplier. Engage the vendor before the questionnaire goes out; the engagement step is ours. A reply written in marketing language scores Told or Blank on what it shows. That alone is no ground for suspicion.
Adding Up the Replies and What the Total Tells You
Read in this order, and keep the first round’s questions and marks for the next review.
- Read the five gate marks, then the group totals (access, data, incidents and staff, the vendor’s own suppliers, assurance), then the sum. Write the sum as points earned over points possible for the depth, for example 20 of 22.
- A high sum with a Told on a gate is a different case from a lower sum with every gate Shown. The gates test the vendor’s side of the logins you are about to hand over, which is Signisys’ reasoning.
- Ask the same questions at the next review, so you can set the replies side by side. The article sets no interval.
Illustration, not a client: a depth-B vendor scores 20 of 22. The shortfall sits in questions 4 and 7, both Told, and every gate scores Shown. A decision here turns on those two replies, not the sum.
Where This Security Assessment Questionnaire Stops
The questions record what a vendor says and shows about itself. When you total the replies, the score is the firm’s reading, not an audit, a certificate or a legal view. The questionnaire tests nothing inside your own environment; your own settings need a separate look. How a vendor reaches those settings is the subject of a comparison of VPN, ZTNA and PAM routes for vendors.
It is not a contract review, and the article draws on no India or GCC rule. It also does not cover backups, change management or privacy questions, which sit outside access. Nor does it choose technology. A list of the ways outside access goes wrong, and a how-to on running that access, are separate articles in this series. For the wider picture, read the wider supplier risk programme and the secure third-party and vendor access use case.
Get specialist help when the vendor holds admin rights, has had an incident, or will not answer a gate question.
The free Third-Party Access Review on the use-case page looks at your side of that access. Signisys provides identity and access management and agrees the scope for each engagement. This is a Signisys offer, not neutral advice. The Signisys use case is Secure Third-Party and Vendor Access. The solution is Identity and Access Management (IAM), and the service is Cybersecurity Services.
Security Assessment Questionnaire FAQ
Who should send a security assessment questionnaire, and when?
Does every vendor get all 15 questions?
Which replies should I read first?
What should I do if a vendor refuses to answer?
How do I read a vendor’s certificate?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.