Answer guides · 127 questions
How to answer security questionnaire questions
Every vendor security questionnaire asks the same few dozen things in different words. Each guide below takes one of those questions and explains what the buyer is trying to find out, the other ways it gets asked, and the evidence to have ready. Start with the topic in front of you.
- Describe your data encryption at rest strategy.
- What protocols and standards are used for data in transit encryption (e.g., TLS 1.2+)?
- Describe your cryptographic key management: generation, rotation, revocation, and destruction of keys.
- How do you manage and rotate encryption keys?
- Can customers supply, manage, or revoke their own encryption keys (BYOK or customer-managed keys) for the data you hold on their behalf?
- How do you manage secrets including API keys, credentials, and certificates?
- How do you isolate data between different tenants or customers?
- Describe your data retention and destruction policies.
- How do you classify and label data?
- Where do you store sensitive/regulated data?
- Which groups of personnel (employees and contractors) have access to personal and sensitive data?
- How do you mask, anonymize, or tokenize sensitive data in non-production environments?
- Describe your multi-factor authentication (MFA) implementation.
- Do you support Single Sign-On (SSO) or SAML integration?
- Do you implement the least privilege principle for system access?
- How do you implement role-based access control (RBAC)?
- How do you handle privileged access management (PAM)?
- What is your process for user access provisioning and deprovisioning?
- How frequently are access rights reviewed?
- How do you manage user authentication and authorization?
- Describe your password/credential policies (length, complexity, rotation).
- How are user passwords stored and protected (hashing algorithms, salting)?
- How do you monitor and review access logs?
- Describe your secure development lifecycle (SDLC).
- How do you conduct code reviews?
- What application security testing do you perform (SAST/DAST)?
- Is security testing automated in your CI/CD pipeline?
- How do you manage open source components and dependencies (SCA)?
- How do you manage application vulnerabilities?
- How is threat modeling incorporated into your design and development process?
- Is application deployment automated with proper controls?
- Describe your API security controls.
- Do you implement API rate limiting to prevent abuse?
- How do you securely store and manage API keys?
- Does your application support IP allowlisting for user authentication or API access?
- Does your application provide customers with a change log of product and application changes?
- Do you provide sandbox environments for customers to test changes?
- Describe your incident response plan (IRP).
- What is your SLA for notifying customers of a security breach?
- Describe your breach notification procedures.
- How do you detect security incidents?
- How long do you retain security logs?
- What is your SIEM strategy?
- How are the clocks of your processing systems synchronized to a reliable and auditable time source?
- How do you report and respond to monitoring system anomalies and failures?
- How do you handle data subject access requests (DSAR)?
- Describe your process for data deletion/right to be forgotten.
- How do you handle international data transfers?
- Have you appointed a Data Protection Officer (DPO)?
- Do you conduct data protection impact assessments (DPIAs) when processing personal data?
- Are systems configured privacy-by-default, in line with applicable laws and regulations?
- How do you obtain and manage consent?
- What privacy notices do you provide?
- Do you claim rights to use customer data for your own purposes?
- Do you sell customer data to third parties?
- Do you sign Business Associate Agreements (BAAs) with customers?
- How do you ensure PHI confidentiality, integrity, and availability?
- How do you handle minimum necessary access to PHI?
- Describe your process for HIPAA authorizations.
- How do you protect cardholder data?
- How do you limit data retention for payment card information?
- How do you maintain your ISMS (Information Security Management System)?
- Describe your management review process.
- Describe your control environment.
- How do you define and monitor trust service criteria?
- Describe your backup strategy and frequency.
- How often do you test data restoration from backups?
- What is your RTO (Recovery Time Objective)?
- Do you have a documented disaster recovery plan that is tested regularly?
- Describe your business continuity plan.
- How do you ensure high availability of critical systems?
- Describe your firewall configuration and management.
- How do you segment your network?
- What intrusion detection/prevention systems (IDS/IPS) do you use?
- How do you protect against DDoS attacks?
- Describe your VPN and remote access security.
- How do you secure wireless networks?
- Is equipment identification — for example device certificates or registered device identity — used as a method of authenticating connections to your systems?
- Which cloud service providers (CSP) do you use to host your services?
- How do you document and apply the shared security responsibility model (SSRM) between your organization, your cloud providers, and your customers?
- How do you manage configuration and hardening of cloud infrastructure?
- How do you segregate production and non-production environments?
- Do you utilize a Web Application Firewall (WAF)?
- Can customers export their data programmatically, and what portability and exit provisions exist (formats, retention, deletion on termination)?
- How do you inventory and track hardware and software assets?
- How are company endpoints (laptops and workstations) managed, inventoried, and secured?
- What protections are enforced on managed endpoints (anti-malware, firewalls, disk encryption, screen lock, remote wipe, DLP)?
- What are the allowances and conditions for acceptable use of organization-owned or managed assets?
- Describe your hardware disposal/destruction process.
- What is your process for decommissioning systems?
- Do you perform background checks on all employees and contractors?
- Do employees sign confidentiality or non-disclosure agreements (NDAs)?
- Describe the security onboarding and offboarding process for employees.
- What is the process for handling security violations by employees?
- What controls require unattended workspaces to be cleared, with papers, screens, and removable media holding sensitive information concealed or secured?
- What compliance certifications do you maintain (e.g., SOC 2, ISO 27001)?
- Do you conduct independent third-party security assessments annually?
- How often do you conduct internal audits?
- How do you track and remediate audit findings?
- Describe your compliance monitoring program.
- What formal information security policies do you maintain, and how are they documented, approved, and reviewed?
- What technical and operational security metrics do you define, collect, and report against your business objectives?
- Do administrators have access to detailed audit logs with export capabilities?