Government & Compliance
Vendor security questionnaires: what agencies ask and how vendors should answer
The purpose of security questionnaires, common questions, and how to make the process useful for both sides.
Before an agency entrusts a vendor with its data or systems, it needs to understand the vendor's security. The security questionnaire is the standard tool. Done well, it is a useful exchange; done poorly, it is a compliance ritual nobody reads.
What agencies are trying to learn
Whether the vendor has the basic controls in place, whether it has independent validation such as an audit report or authorization, how it handles the agency's data, and what happens when something goes wrong.
Common questions
- Multi-factor authentication for staff and administrators
- Encryption in transit and at rest
- Access control and background checks for staff with data access
- Vulnerability management and patching
- Logging, monitoring, and incident response
- Backup and recovery
- Data location, retention, and deletion
- Subcontractors and their controls
- Independent assessments: SOC 2, ISO 27001, StateRAMP, FedRAMP
- Cyber insurance
- Breach notification commitments
What to expect from vendors
Answer accurately. Overstating creates liability and is discovered. Where a control is not in place, say so and describe the plan. Keep an evidence library so that answers are consistent and fast. Standard questionnaire formats reduce effort for everyone.
For agencies
Tailor the questionnaire to the risk. A vendor delivering a public website needs fewer questions than one hosting criminal justice data. Read the answers. Follow up on gaps. Require the important commitments in the contract, not only in the questionnaire.
HQT's practice
HQT maintains a written security program aligned to the NIST Cybersecurity Framework, answers questionnaires from it, and provides evidence for each answer.