The SOC 2 Vendor Security Questionnaire: What to Ask (+ Free Template)

If you are pursuing SOC 2, your auditor will expect you to assess the security of the vendors who touch your data. A good vendor security questionnaire makes that assessment consistent and defensible. Here is what to cover.

Governance and certifications

Ask whether the vendor has a documented, annually reviewed security policy, a named security owner, and current certifications (SOC 2, ISO 27001, PCI DSS). Existing attestations can shortcut much of your review.

Access control

Confirm MFA is enforced for all accounts, access follows least privilege and is reviewed regularly, and access is revoked promptly when staff leave. Weak access control is behind a large share of breaches.

Data protection and encryption

Verify encryption in transit (TLS 1.2+) and at rest, a data classification scheme, and clear retention and deletion policies. Ask how encryption keys are managed and rotated.

Infrastructure and application security

Cover cloud provider and regions, separation of production from test, patching SLAs, peer-reviewed changes, dependency scanning and a secure SDLC.

Logging, monitoring and incident response

Ask about centralized logging, retention, alerting, a tested incident response plan, and — critically — their committed breach-notification timeline.

Business continuity and sub-processors

Confirm tested backups, documented RTO/RPO, and a current list of sub-processors with access to your data, each of which the vendor should assess in turn.

Get the template

We packaged 50+ of these questions, grouped by domain, into a free vendor security questionnaire template you can send today — or import into Complyzing to score responses automatically.