Supplier IT Security Questionnaire

A 60-question security questionnaire to send to IT providers, software and cloud suppliers, outsourced payroll or bookkeeping firms and any other supplier that will hold your data or access your systems. It is grouped by topic, flags critical questions, and includes a simple scoring method, a risk rating and a record of your decision.

• Before appointing a supplier who will process personal or confidential data, or have access to your network
• When renewing a key contract, and at least every [two] years for high-risk suppliers
• To support the due diligence you must do before appointing a data processor under UK GDPR

• Decide the supplier’s risk tier using Part 1 and delete sections that do not apply
• Send Parts 2 to 4 to the supplier and ask for evidence for critical questions
• Score the answers using Part 5 and record your decision in Part 6
• Keep the completed questionnaire with the contract and diarise the next review