Security questionnaire answers › Vendor management
How do you assess the security of your own vendors and subprocessors? How to answer it in a security questionnaire
Why buyers ask this
Your suppliers touch their data too, so buyers want a managed supply chain.
What a strong answer includes
- Describe risk-tiering and due diligence (questionnaire, SOC 2 or ISO report review).
- Say how often critical vendors are reviewed.
- Provide a subprocessor list and change notification process.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
New vendors are risk-tiered and reviewed before onboarding, including security documentation such as SOC 2 or ISO 27001 reports for those processing customer data. Critical vendors are reviewed [annually]. Our current subprocessor list is at [URL], and we notify customers of changes [30 days] in advance.
Evidence to attach
- Vendor management policy
- Subprocessor list
- Sample vendor review
Common mistakes
- No subprocessor list.
- Reviewing vendors only at onboarding.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.