Vendor Risk Assessment v1.

0 <Insert Entity Logo>

Procurement to incorporate this section in every RFP / RFQ released, based on the applicability of Vendor Risk
Assessment Process. Obtain this information from vendor and evaluate the risk score pertaining to Information
Security requirements.

Instructions:

 Please complete the following questionnaire.

 For any queries or details required, please describe in Justification/Comments Section OR mention at the end of
the questionnaire OR attach documentation with the required information.
 Mention Not Applicable wherever relevant, with appropriate justifications or comments.

Note: Vendor has to comply with minimum ----- % of the below Mandatory Questionnaire to be eligible to pass the
technical evaluation process.

Vendor Risk Assessment Questionnaire

Risk Assessment Categories Compliance Justification / Comments

Status
Yes No
Mandatory Requirements

1. Does your Organization have Information security ☐ ☐

(IS) policy, which is approved by your management,
published and communicated to all employees? Are IS
Policies reviewed on an ongoing basis?

2. Do you sign Confidentiality or non-disclosure ☐ ☐

agreements with your company employees and/or
third party personnel, as employed or engaged by
your company?

3. Is security requirements such as background ☐ ☐

verifications, information security awareness, etc. are
addressed for all employees and third party
personnel?

4. Are security roles and responsibilities documented and ☐ ☐

communicated to all employees and third parties
through appropriate Information Security awareness
training and regular updates?

5. Are responsibilities for the protection of customer ☐ ☐

information/assets, and Organizational
information/assets clearly defined?

Desired Requirements
 Vendor Risk Assessment v1.0 <Insert Entity Logo>

1. Does your Organization comply with the requirements ☐ ☐

of the ISO/IEC 27001:2013 Standard, and Certified
against those requirements? Are you aware of
ADHICS Standard requirements?

2. Is there an information classification scheme or ☐ ☐

guideline in place, which will assist in determining
how the information is to be handled and protected?
Are your employees, sub-contractors & third parties
made aware to adhere with such classification
schemes?
3. Is there a defined employee exit process, and is the ☐ ☐
employee exit process includes communication to
customers?
4. Are physical identification Badges provided to all ☐ ☐
employees and third party users working within the
Organization premises or at the client sites?
5. Do you follow a formal Change Management ☐ ☐
Procedure for implementing changes to information
processing facilities, assets or services offered to
customers?
6. Do you have a procedure for recording audit logs for ☐ ☐
user actions, exceptions, and information security
events?
7. Do you have a formal user registration and ☐ ☐
deregistration process for granting/revoking access to
information systems and services?
8. Do you have a password management requirements ☐ ☐
defined that enforces various password controls?

9. Do you have a security incident reporting process in ☐ ☐

place? Are employees aware of the requirements of
the process, and are trained to report security
weakness or events through defined channels as
quickly as possible?
10. Do you have Business Continuity Management (BCM) ☐ ☐
in place? Does your Business continuity planning
address the requirements of ensuring continuity of
services to your customers and business stakeholders?

Vendor’s authorized signature: ________________________________Name_______________________________________

Vendor’s Stamp: ___________________________________________________Date_________________________________