loading_
Managing third-party risk shouldn't be a headache. Generate a tailored security questionnaire for your vendors in seconds to ensure they meet your standards.
It generates a proportionate supplier security questionnaire for the vendor and risk level you describe, rather than the 200-question spreadsheet that small suppliers ignore and large ones answer with boilerplate.
The questions are written to produce answers you can act on, focusing on access, data, authentication and what happens when the supplier has an incident.
Send it to the right person
Sales contacts will pass a security questionnaire to whoever is free. Ask for the person accountable for security, and note the answer if there is not one.
Read what is missing, not just what is answered
Vague or deflected answers are findings. A supplier who cannot say how they verify identity before a password reset has told you something important.
Ask what happens when they have an incident
The most useful question is rarely about controls. It is how quickly they will tell you, who they will tell, and what you are contractually owed. Get that into the contract.
Decide what you will actually do about a poor answer
Assessment without a consequence is theatre. Before you send it, know which answers would change your decision.
It produces questions, not assurance. It cannot verify anything a supplier tells you, and suppliers answer questionnaires optimistically. It also cannot assess the supplier’s suppliers, which is where a great deal of real risk sits. Treat the responses as the beginning of a conversation, not as evidence.
Proportionate to what the supplier can reach. A supplier holding customer data or with administrative access to your systems warrants real scrutiny; one supplying stationery does not. Over-long questionnaires are counterproductive because they get boilerplate answers from large suppliers and are ignored by small ones.
What happens when they have an incident: how quickly they will tell you, who they will tell, what information you will get and what you are contractually owed. Controls change over time; the incident commitment is what protects you when they fail. The 2025 UK retail attacks reached their targets through a third-party help desk.
Treat the boilerplate as the finding. Ask one or two specific follow-up questions tied to your actual use of them, such as how they verify identity before resetting a password on your account. Specific questions are much harder to answer generically and tell you far more.
For anything critical, yes, at least to the extent of knowing who they are. Only 6% of UK businesses look at their wider supply chain, and concentration risk in that layer is one of the least examined exposures in UK cyber security.