A third-party risk questionnaire template is a structured list of security questions you send to a vendor, with the evidence you expect back, so you can rate the risk of using them. This one adds vendor tiering, a scoring method and a list of external signals you can check without asking the vendor, such as exposed assets, leaked credentials, leak-site listings and lookalike domains.
- Tier vendors first, so the full 41 questions go only to the vendors that could hurt you most.
- Ask for evidence on the six Critical questions; a Yes without proof scores as Partial.
- Score with fixed weights and bands, and let a No on a Critical question or a confirmed external signal raise the band.
- Check what you can from outside, such as exposed assets, leaked credentials, leak-site listings and lookalike domains, between questionnaires.
Maps to
- NIST CSF 2.0 Govern function, category GV.SC (cybersecurity supply chain risk management), outcomes GV.SC-01 to GV.SC-10
- NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (May 2022, Update 1 of November 2024)
- ENISA Threat Landscape for Supply Chain Attacks (July 2021)
- NIS2 Directive (EU) 2022/2555 Article 21(2)(d) and 21(3), supply chain security
- DORA Regulation (EU) 2022/2554 Articles 28 to 30, ICT third-party risk
What Is A Third-Party Risk Questionnaire Template And How Do You Use It?
A third-party cyber risk questionnaire asks a vendor how it protects your data and your systems, and asks for proof. You use it before you sign (due diligence) and again on a schedule while the vendor works for you. The answers feed a score, the score feeds a decision, and the decision is recorded.
Use the template in this order:
- Record the vendor, the service and the data involved (the vendor profile section).
- Tier the vendor so effort matches risk (the tiering section).
- Send the questions your tier calls for (the three question sections) and ask for the expected evidence.
- Score the answers and apply the rules (the scoring section).
- Check external signals about the vendor in parallel (the external signals section).
- Decide, record actions with owners and dates, and set the next review (the review section).
If you are buying a tool to run this process, the RFP questions guide covers what to ask platform vendors, and the approaches buyer’s guide compares feeds, platforms and managed services. For the idea behind the topic, see the glossary entries on third-party risk and supply chain attack.
How Do You Tier Vendors Before You Send Anything?
Not every vendor needs 41 questions. Tiering sorts vendors by how much damage a failure or breach on their side could do to you, so the longest review goes to the few that matter. NIST CSF 2.0 states the same idea as an outcome: suppliers are known and prioritized by criticality (GV.SC-04).
Step 1: score the vendor on five questions
Give each row 0 to 3 points. Add them up. The point bands below are a starting set; change them to fit your company.
| Factor | 0 points | 1 point | 2 points | 3 points | Score |
|---|---|---|---|---|---|
| Data they hold | None | Internal, low sensitivity | Personal or confidential data | Regulated data, secrets or keys | [ ] |
| Access to your systems | None | Read only, one app | Limited write access | Privileged or network-level access | [ ] |
| Impact if they are down | No effect | Work slows, workaround exists | A business process stops for days | A core service or revenue stops within hours | [ ] |
| How hard to replace | Same-day swap | Weeks | Months | Not realistic in a year | [ ] |
| Regulatory or contract weight | None | Some customers ask | A contract or law requires oversight | Supports a critical or important function under a regulation | [ ] |
| Total (0 to 15) | [ ] |
Step 2: assign the tier
| Tier | Score | Override rule | What the vendor receives |
|---|---|---|---|
| Tier 1, critical | 10 to 15 | Always Tier 1: privileged access to production, or support of a critical or important function | All questions in the three question sections, evidence for every Critical and High item, external signal check [monthly or continuous] |
| Tier 2, important | 5 to 9 | Questions rated Critical and High, evidence for Critical items, external signal check [quarterly] | |
| Tier 3, standard | 0 to 4 | Questions rated Critical only, public information check [at renewal] |
Write the tier in the vendor profile. Re-tier when the service changes, for example when a vendor gets access to a new data type.
What Do You Record About Each Vendor First?
Fill this table before you send questions. It shows the reviewer what the vendor does for you and gives you the contact to use if an external signal needs a conversation.
| Field | Your entry |
|---|---|
| Vendor legal name and website | [Name, domain] |
| Service we use | [What the vendor does for us] |
| Business owner at our company | [Name, team] |
| Vendor security contact | [Name, email, phone for out-of-hours incidents] |
| Data types we share | [Customer data, employee data, source code, payment data, none] |
| Systems the vendor connects to | [List, with the type of access] |
| Vendor domains and main internet-facing hosts | [List; used for the external signal check] |
| Known subcontractors | [List, from the vendor] |
| Tier (from the tiering section) and score | [Tier, total] |
| Questionnaire sent / returned | [Date / Date] |
| Reviewer | [Name] |
What Should You Ask About Governance And Access?
These sections cover who owns security at the vendor and how access to your data is controlled. Each row has a weight in the Risk flag column: Critical counts 3, High counts 2, Medium counts 1 in the scoring method. Replace [bracket] values with your own.
Section A: Governance and ownership
| Question | Expected evidence | Answer | Risk flag |
|---|---|---|---|
| A1. Is a named person or team responsible for information security? | Role description or organization chart. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
| A2. Do you have a written security policy, approved by management and reviewed in the last [12] months? | Policy with approval and review dates. | [Yes / Partial / No / N/A] | Medium. Flag if No or Partial. [ ] |
| A3. Does an independent audit or certification cover the service we use? State the scope. | Certificate or audit report, scope statement, date. | [Yes / Partial / No / N/A] | Medium. Flag if No or Partial. [ ] |
| A4. Do you assess the risks to your own systems and suppliers at least once a year? | Risk register extract or assessment summary. | [Yes / Partial / No / N/A] | Medium. Flag if No or Partial. [ ] |
| A5. Does every person with access to our data complete security training on joining and each year? | Training content and completion records. | [Yes / Partial / No / N/A] | Medium. Flag if No or Partial. [ ] |
Section B: Access and identity
| Question | Expected evidence | Answer | Risk flag |
|---|---|---|---|
| B1. Is multi-factor authentication required for all administrator accounts and all remote access? | Configuration screenshot or policy with enforcement settings. | [Yes / Partial / No / N/A] | Critical. Flag if No. [ ] |
| B2. Can our users sign in to your service with multi-factor authentication or single sign-on? | Product documentation. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
| B3. Is access granted by role, reviewed at least every [6 to 12] months, and removed when someone leaves? | Access review record and leaver process. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
| B4. Is vendor staff access to our data or environment limited and logged? | Description of logging and a sample log entry. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
| B5. How do you manage shared, service and privileged accounts (vault, rotation)? | Procedure and tool description. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
| B6. Do you reset staff credentials when they appear in a breach or an infostealer log? | Procedure for handling leaked credentials. | [Yes / Partial / No / N/A] | Medium. Flag if No or Partial. [ ] |
What Should You Ask About Data, Development And Vulnerabilities?
These sections cover where your data lives, how the vendor builds and patches its systems, and whether it knows what it exposes to the internet. NIS2 Article 21(3) asks entities to consider the vulnerabilities of each direct supplier and its secure development practices, which is why section D is detailed.
Section C: Data protection
| Question | Expected evidence | Answer | Risk flag |
|---|---|---|---|
| C1. Which of our data types do you store or process, and in which countries? | Data inventory or data flow diagram. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
| C2. Is our data encrypted in transit and at rest? | Technical description with algorithms and key lengths. | [Yes / Partial / No / N/A] | Critical. Flag if No. [ ] |
| C3. Who manages the encryption keys, and can we hold our own? | Key management description. | [Yes / Partial / No / N/A] | Medium. Flag if No or Partial. [ ] |
| C4. Is our data logically separated from other customers’ data? | Architecture description. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
| C5. Can you delete our data at the end of the contract and confirm it in writing? | Retention schedule and deletion procedure. | [Yes / Partial / No / N/A] | Medium. Flag if No or Partial. [ ] |
| C6. Are backups encrypted, and has a restore been tested in the last [12] months? | Backup policy and last test record. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
Section D: Secure development, vulnerabilities and exposure
| Question | Expected evidence | Answer | Risk flag |
|---|---|---|---|
| D1. Do you follow a secure development process, with code review and testing before release? | Process document or tooling summary. | [Yes / Partial / No / N/A] | Medium. Flag if No or Partial. [ ] |
| D2. How fast do you patch critical vulnerabilities on internet-facing systems? State your target in days. | Patch policy with target times and a sample record. | [Yes / Partial / No / N/A] | Critical. Flag if No or if the target is longer than [14] days. [ ] |
| D3. Is an independent penetration test done at least yearly, and are findings tracked to closure? | Test summary letter and remediation status. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
| D4. Do you keep a current list of systems exposed to the internet, each with an owner? | Asset inventory extract. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
| D5. Do you keep a list of key software components and a process for vulnerabilities in them? | Component list or software bill of materials, process description. | [Yes / Partial / No / N/A] | Medium. Flag if No or Partial. [ ] |
| D6. Is there security monitoring with alerting, and who responds, during which hours? | Monitoring description and on-call arrangement. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
| D7. Is there a public way to report a vulnerability to you? | Link to a disclosure page or security contact file. | [Yes / Partial / No / N/A] | Medium. Flag if No or Partial. [ ] |
What Should You Ask About Incidents, Continuity And Subcontractors?
These sections decide how fast you hear about a problem and how you get out if the relationship fails. The contract questions (E2, F4, G3, H2) match outcomes in NIST CSF 2.0 GV.SC-05 and GV.SC-10.
Section E: Incident response and notification
| Question | Expected evidence | Answer | Risk flag |
|---|---|---|---|
| E1. Do you have a documented incident response plan, tested in the last [12] months? | Plan summary and last exercise report. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
| E2. Will you tell us about an incident that affects our data, and within how many hours of confirming it? | Contract clause or policy stating the hours: [Hours]. | [Yes / Partial / No / N/A] | Critical. Flag if No or if no time limit is given. [ ] |
| E3. Is there one named security contact we can reach outside office hours? | Contact details and escalation path. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
| E4. Has a security incident affected customer data in the last [24] months? What happened and what changed? | Short written summary. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
| E5. Will you take part in our incident exercises and help with logs and investigation? | Contract clause or written commitment. | [Yes / Partial / No / N/A] | Medium. Flag if No or Partial. [ ] |
| E6. Do you keep backups that an attacker cannot change or delete, and do you have a plan for stolen data? | Backup design and data theft response steps. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
Section F: Continuity and exit
| Question | Expected evidence | Answer | Risk flag |
|---|---|---|---|
| F1. What recovery time and recovery point targets apply to our service? | Service description with targets. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
| F2. Is your business continuity plan tested at least yearly? | Test summary. | [Yes / Partial / No / N/A] | Medium. Flag if No or Partial. [ ] |
| F3. Which single points of failure remain (one region, one provider, one person)? | Architecture or resilience summary. | [Yes / Partial / No / N/A] | Medium. Flag if No or Partial. [ ] |
| F4. If we leave, how do we get our data back in a usable format, and how long does the move take? | Exit procedure and data return format. | [Yes / Partial / No / N/A] | Critical. Flag if No. [ ] |
Section G: Subcontractors and fourth parties
| Question | Expected evidence | Answer | Risk flag |
|---|---|---|---|
| G1. Which subcontractors can store or access our data, and in which countries? | List with locations. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
| G2. Do your contracts with them require the same security standards you accept from us? | Contract clause or policy. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
| G3. Will you tell us before you add or change a subcontractor that handles our data? | Contract clause with notice period: [Days]. | [Yes / Partial / No / N/A] | Medium. Flag if No or Partial. [ ] |
| G4. Do you review the security of your own critical suppliers? | Supplier review procedure. | [Yes / Partial / No / N/A] | Medium. Flag if No or Partial. [ ] |
Section H: Legal and assurance
| Question | Expected evidence | Answer | Risk flag |
|---|---|---|---|
| H1. Which security and data protection laws apply to you for this service, and are you in scope of NIS2, DORA or a sector rule? | Written statement. | [Yes / Partial / No / N/A] | Medium. Flag if No or Partial. [ ] |
| H2. Do we have the right to audit you, or to receive an independent report, at least once a year? | Contract clause or standing report. | [Yes / Partial / No / N/A] | High. Flag if No or Partial. [ ] |
| H3. Will you sign a data processing agreement covering our data? | Signed agreement or template. | [Yes / Partial / No / N/A] | Critical. Flag if No. [ ] |
The template has 41 questions in eight sections (A to H). Six are rated Critical, one each in sections B, C, D, E, F and H.
How Do You Score The Answers?
The method gives the same answer whoever scores. Each question is worth its weight (Critical 3, High 2, Medium 1). Each answer earns risk points as a share of that weight. The result is a percentage of possible risk, which maps to a band.
| Answer | Risk share | Rule |
|---|---|---|
| Yes, with the expected evidence | 0 | Full control shown. |
| Yes, without evidence | 0.5 | Treat as Partial until the evidence arrives. |
| Partial | 0.5 | Some control, not complete. |
| No, or no answer | 1 | Unanswered counts as No. |
| N/A | Left out | Remove the question from the total as well. Write the reason. |
Risk percentage = sum of (weight times risk share) divided by the sum of the weights of all applicable questions. Do it per section and for the whole questionnaire.
Worked example with five questions
| Question | Weight | Answer as scored | Risk points | Possible |
|---|---|---|---|---|
| B1 MFA for admin and remote access | 3 | Yes, no evidence (0.5) | 1.5 | 3 |
| D2 Patch critical flaws | 3 | Yes with evidence (0) | 0 | 3 |
| E2 Incident notification | 3 | No (1) | 3 | 3 |
| C4 Data separation | 2 | Partial (0.5) | 1 | 2 |
| A2 Security policy | 1 | Yes with evidence (0) | 0 | 1 |
| Total | 5.5 | 12 |
5.5 divided by 12 is about 46 percent, which falls in the High band. This is an illustration, not a benchmark.
Bands and rules
| Risk percentage | Band | Typical decision |
|---|---|---|
| Under 20 | Low | Approve. Next review by tier. |
| 20 to 39 | Moderate | Approve with written actions, owners and dates. |
| 40 to 59 | High | Approve only with compensating controls and sign-off by a senior owner. Re-check in [90] days. |
| 60 or more | Very high | Do not onboard. For an existing vendor, start exit planning. |
- Critical question rule: if any Critical question is answered No, the vendor cannot rate below High until it is fixed.
- External signal rule: a confirmed external signal (see the external signals section) moves the vendor up one band until the cause is closed.
- Evidence rule: for Tier 1, a missing document for a Critical or High item is scored as Partial.
Bands and thresholds here are starting values chosen for clarity. They are not taken from a standard, so adjust them to your own risk appetite and keep a record of the change.
What Can You Check About A Vendor Without Asking Them?
A questionnaire shows what the vendor says. External signals show what is visible from outside, at any time, without asking. Together they are stronger than either alone.
| Topic | Questionnaire | External signals |
|---|---|---|
| Source | The vendor’s own statements | Evidence seen from outside |
| Good at | Policies, processes and contracts | Exposure, leaks and incidents |
| Weak at | Out-of-date or optimistic answers | Cannot see inside the vendor |
| Timing | A point in time, often yearly | Any time, between reviews |
Look at these signals for every Tier 1 and Tier 2 vendor. Each row names the questionnaire items it can confirm or contradict and the Brandefense how-to-respond page for the next step.
| Signal | What to look for | Check against | If you find it |
|---|---|---|---|
| Exposed assets | Vendor servers, admin panels or storage open to the internet that the vendor did not list | D4, D3 | Unknown exposed assets, misconfigurations |
| Changes in exposure | New hosts, new subdomains or services that appear between reviews | D4, G1 | Supplier’s new exposure signal |
| Leaked credentials | Vendor staff accounts, or your accounts at the vendor, in leaked data | B1, B3, B6 | Leaked credentials, infostealer logs |
| Leak-site listing | The vendor named on a ransomware or extortion leak site | E1 to E6, C1 | Supplier on a leak site |
| Access for sale | Access to the vendor offered on a criminal forum | B1 to B5 | Initial access listings |
| Lookalike domains | Domains that imitate the vendor and could be used for fake invoices or changed bank details | E3, G4 | Lookalike and phishing domains |
| Exploited vulnerabilities | Vendor internet-facing software with a flaw that attackers already use | D2, D5 | Actively exploited vulnerabilities |
Rules for the external check
- Use public sources and lawful monitoring only. Do not scan the vendor’s systems beyond what your contract and local law allow.
- Never buy, download or open stolen data yourself. Work from the facts a monitoring service reports.
- Treat a signal as a lead. Contact the vendor’s security contact (see the vendor profile) and ask them to confirm.
- Record every signal with the date, the source and the vendor’s reply.
Signal log
| Date | Vendor | Signal | Source | Vendor reply | Band change |
|---|---|---|---|---|---|
| [Date] | [Name] | [Type from the table above] | [Where seen] | [Confirmed / Not confirmed] | [Yes / No] |
| [Date] | [Name] | [Type] | [Where seen] | [Reply] | [Yes / No] |
The use cases for supply chain and vendor risk, leaked credential monitoring and phishing and lookalike domains describe how teams run these checks day to day. The EASM 101 guide explains exposed assets, and the attack surface management buyer’s guide helps if you plan to buy a tool for it.
What Do NIST, ENISA, NIS2 And DORA Say About Suppliers?
This template is not a legal checklist. It is built on public frameworks, and you should confirm the legal duties with your counsel. Here is what the sources say, in short.
NIST CSF 2.0 and SP 800-161 Rev. 1
NIST CSF 2.0 (February 2024) has a Govern function with a category for cybersecurity supply chain risk management, GV.SC, which has ten outcomes. NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (May 2022, Update 1 of November 2024), gives detailed practices for identifying, assessing and mitigating supply chain risk. Our own mapping of this template to the CSF outcomes is below. It is for orientation and is not an official crosswalk.
| Template part | CSF 2.0 outcome | Meaning in short |
|---|---|---|
| Tiering | GV.SC-04 | Suppliers are known and prioritized by criticality. |
| Vendor profile and questionnaire before onboarding | GV.SC-06 | Planning and due diligence happen before the relationship starts. |
| Contract questions: E2, F4, G3, H2, H3 | GV.SC-05, GV.SC-10 | Requirements go into contracts, and plans cover the end of the relationship. |
| Scoring, reviews and external signals | GV.SC-07 | Supplier risk is understood, assessed and monitored over the whole relationship. |
| Exercise question E5 | GV.SC-08 | Suppliers are included in incident planning, response and recovery. |
| Ownership and program (A1, A4) | GV.SC-01, GV.SC-02, GV.SC-03, GV.SC-09 | A program exists, roles are clear, and it joins enterprise risk management. |
ENISA
ENISA’s Threat Landscape for Supply Chain Attacks (July 2021) studied supply chain attacks from January 2020 to early July 2021. It found that these attacks grew in number and sophistication, and it calls for protective strategies that include supply chain partners.
NIS2 for EU entities
In Directive (EU) 2022/2555, Article 21 lists supply chain security, including the security aspects of the relationship with direct suppliers and service providers, among the minimum risk-management measures (21(2)(d)). Article 21(3) says entities take into account the vulnerabilities specific to each direct supplier, the overall quality of their products and their cybersecurity practices, including secure development. Sections D and E of the questionnaire gather this information. See the NIS2 glossary entry, the posts on NIS2 transposition status and incident reporting deadlines.
DORA for EU financial entities
In Regulation (EU) 2022/2554, Article 28 treats ICT third-party risk as part of ICT risk management and applies proportionality. Article 28(3) requires a register of information on contractual arrangements. Article 29 covers concentration risk. Article 30 lists contract elements, including the locations where data is processed, return of data, help during incidents, termination rights, and for critical or important functions, notice and reporting duties, contingency plans and rights of access, inspection and audit. Questions C1, E2, F4, G1 and H2 line up with these themes. Read the DORA glossary entry, the post on DORA in 2026 and what NIS2 and DORA require for third-party risk management.
Sources and references
- NIST Cybersecurity Framework 2.0, NIST CSWP 29, February 2024
- NIST SP 800-161 Rev. 1, May 2022, Update 1 of November 2024
- ENISA, Threat Landscape for Supply Chain Attacks, July 2021
- Directive (EU) 2022/2555 (NIS2), Article 21
- Regulation (EU) 2022/2554 (DORA), Articles 28 to 30
How Often Should You Review A Vendor, And What Do You Record?
Review on a schedule and when something changes. The schedule below is a starting point; set your own and write it down. A yearly questionnaire alone leaves long gaps, which is why the external signal check runs in between. The post on continuous monitoring versus the annual audit explains the gap.
| Tier | Full questionnaire | External signal check | Also review when |
|---|---|---|---|
| Tier 1 | Every [12] months | [Monthly or continuous] | The vendor reports an incident, changes subcontractors, is named in a signal, or the service scope changes |
| Tier 2 | Every [12 to 24] months | [Quarterly] | Same triggers |
| Tier 3 | At renewal or every [24 to 36] months | [At renewal] | Same triggers |
Action tracker
| Finding | Question or signal | Action asked of the vendor | Owner | Due date | Status |
|---|---|---|---|---|---|
| [What is wrong] | [ID] | [What you ask for] | [Name] | [Date] | [Open / Closed] |
| [What is wrong] | [ID] | [What you ask for] | [Name] | [Date] | [Open / Closed] |
Review record
| Field | Your entry |
|---|---|
| Vendor and tier | [Name, tier] |
| Risk percentage and band | [Percent, band] |
| Critical question rule applied | [Yes / No] |
| External signals checked on | [Date], result [None / see log] |
| Decision | [Approve / Approve with conditions / Remediate first / Do not proceed] |
| Approver and date | [Name, date] |
| Next review | [Date] |
- Tier the vendor and fill the profileTiering and vendor profile sections.
- Pick the sections for the tierThe three question sections.
- Check external signals firstExternal signals section, so you know what to ask.
- Set a reply date and name a contactGive the vendor a fair time.
- Decide who scores and who approvesTwo people for Tier 1.
Vendors that handle many items on this list benefit from continuous monitoring. The Brandefense third-party risk management page and the platform show how external signals about suppliers can be followed between reviews, and EASM and dark web monitoring cover the exposed asset and leak parts. If a vendor incident touches your own plan, see the incident response plan template and the ransomware response playbook.
Questions.
-
What is a third-party cyber risk questionnaire?
It is a set of security questions a company sends to a vendor to learn how it protects data and systems, with the evidence expected back. The answers are scored to support a decision to approve, condition or refuse the vendor.
-
How many questions should a vendor security questionnaire have?
It depends on the vendor's tier. This template has 41 questions for the highest tier, the High and Critical items for the middle tier and the 6 Critical items for low-risk vendors.
-
How do you score a vendor risk questionnaire?
Give each question a weight, give each answer a share of risk, and divide the risk points by the total possible. Then map the percentage to a band and apply override rules, as the scoring section shows.
-
How often should you reassess third-party vendors?
Many teams review critical vendors yearly and others less often, and also after any trigger such as an incident or a change of subcontractor. Checking external signals in between covers the gaps.
-
Can you assess a vendor without sending a questionnaire?
Partly. You can check external signals such as exposed assets, leaked credentials, leak-site listings and lookalike domains. These do not show internal controls, so a questionnaire is still needed for Tier 1 and Tier 2 vendors.
Free download
Take the editable file
No form and no email needed. Edit it, fill in the brackets and keep it with your other plans. Current version: v1.0 · October 2026.
- Download DOCX 50 KB
- Download Markdown 31 KB
How to cite this
Brandefense. Third-Party Cyber Risk Questionnaire Template (Free DOCX). v1.0, October 2026. https://brandefense.io/knowledge-hub/guides/vendor-cyber-risk-questionnaire-template/
Change log
- v1.0 · October 2026 First release.