Vendor Risk Assessment

Template
A vendor risk assessment questionnaire (also known as a third-party
risk assessment questionnaire) is designed to help your organization
identify potential weaknesses among your third-party vendors and
partners that could result in a data breach, data leak or other type of
cyber attack.

Vendor security assessment questionnaires are one part of verifying

that your service providers are following appropriate information
security practices and can help with incident response planning and
disaster recovery.

We have broken down the risk assessment questionnaire template

into four sections of questions:

1. Information security and private questions

2. Physical and data center security questions
3. Web application security questions
4. Infrastructure security questions

www.upguard.com 1
Information Security and
Privacy Questions

Does your organization process
personally identifiable information
(PII) or protected health information
(PHI)?

Does your organization have a
security program?

If so, what standards and guidelines
does it follow?

Does your information security
and privacy program cover all
operations, services and systems
that process sensitive data?

Who is responsible for managing
your information security and
privacy program?

What controls do you employ as
part of your information security
and privacy program?

Please provide a link to your public
information security and/or privacy
policy

Are there any additional details you
would like to provide about your
information security and privacy
program?

What regulation and other
requirements does you organization
have to comply with?
www.upguard.com
Physical and Data Center
Security Questions

Are you in a shared office?

Do you review physical and
environmental risks?

Do you have procedures in place for
business continuity in the event that
your office is inaccessible?

Do you have a written policy for
physical security requirements for
your office?

Is your network equipment
physically secured?

What data center providers do you
use if any?

How many data centers store
sensitive data?

What countries are data centers
located in?

Are there any additional details you
would like to provide about your
physical and data center security
program?
2
Web Application Security
Questions

What is the name of your
application? And what does it do?

Do you have a bug bounty
program or other way to report
vulnerabilities?

Does your application have a valid
SSL certificate to prevent man-in-
the-middle attacks?

Does your application require login
credentials?

How do users get their initial
password?

Do you have minimum password
security standards?

How do you store passwords?

Do you offer single sign-on (SSO)?

How can users recover their
credentials?

Does your application employ a
defense in depth strategy? If so,
what?

How do you regularly scan CVE for
known vulnerabilities?

How do you do quality assurance?

Do you employ pentesting?

Who can we contact for more
information related to your web
application security?
www.upguard.com
Infrastructure Security
Questions

Do you have a written network
security policy?

Do you use a VPN?

Do you employ server hardening?

How do you keep your server
operating systems patched?

Do you log security events?

What operating systems are used
on your servers?

Do you backup your data?

How do you store backups?

Do you test backups?

Who manages your email
infrastructure?

How do they prevent email
spoofing? e.g. DMARC

How do you protect employee
devices from ransomware and other
types of malware?

What operating systems do
employee devices use?

Are employee devices encrypted?

Do you employ a third-party to test
your infrastructure security?

Who can we contact in relation to
infrastructure security?
3
Questions? We have answers
We're here to help, shoot us an email at
sales@upguard.com

Know your vendors. Secure yourself.

Looking for a better, smarter way to protect
your data and prevent breaches?

UpGuard offers a full suite of products for

security, risk and vendor management teams.

Trusted by hundreds of companies worldwide

www.upguard.com 650 Castro Street, Suite 120-387, Mountain View CA 94041 United States

+1 888-882-3223
©2022 UpGuard, Inc. All rights reserved. UpGuard and the UpGuard
logo are registered trademarks of UpGuard, Inc. All other products or
services mentioned herein are trademarks of their respective companies.
Information subject to change without notice.