QuestionPunkQuestionPunk
無料で始める
すべてのテンプレート
Privacy & Compliance

Vendor Security and Risk Assessment Questionnaire

Assesses a vendor's security controls, certifications, data handling, and incident history for procurement, security, and compliance teams running third-party risk reviews. An AI follow-up interview digs into the vendor's single most significant unresolved risk instead of accepting a checklist of certifications at face value.

このテンプレートを使うほかのテンプレートを見る

設問の例

テンプレートの内容をプレビューできます。すべての設問は公開前に自由に編集できます。

全13問・約7分
Q01
メッセージ

Thanks for completing this security assessment on behalf of your organization. Your responses are completely confidential and anonymized. It covers certifications, data handling, access controls, and incident history, and takes about 8 minutes. Please answer as accurately as possible — vague answers slow down the review.

Q02
選択式必須

Which of the following security certifications or attestations does your organization currently hold?

  • SOC 2 Type II
  • ISO 27001
  • PCI DSS
  • HIPAA compliance
  • FedRAMP
  • GDPR compliance program
  • None of the above
Q03
選択式必須

How is data belonging to your customers encrypted?

  • Encrypted at rest and in transit
  • Encrypted in transit only
  • Encrypted at rest only
  • Not encrypted
  • Not sure
Q04
マトリクス必須

For each control below, indicate its current implementation status at your organization.

5行 × 5列
  • Multi-factor authentication enforced for employee system access
  • Regular third-party penetration testing
  • Formal, tested incident response plan
  • Mandatory employee security awareness training
  • Documented data retention and deletion policy
列: Fully implemented · Partially implemented · Planned within 12 months · Not implemented · Not sure
Q05
選択式必須

In the last 24 months, has your organization experienced a security incident affecting customer data?

  • Yes — disclosed to affected customers
  • Yes — handled internally, no disclosure required
  • No incidents
  • Not sure / unable to disclose
Q06
選択式必須

Do you use subcontractors or subprocessors who would have access to our data?

  • Yes, and we maintain an up-to-date list we can share
  • Yes, but we don't proactively share a list
  • No subprocessors are used
  • Not sure
Q07
オピニオンスケール必須

How confident are you that your current security program meets the requirements expected of vendors in regulated industries?

スケール: 1 – 7
最小:Not confident at all最大:Extremely confident
Q08
ベスト・ワースト選択（MaxDiff）必須

Which of these security investments is your organization prioritizing most over the next 12 months, and which least?

  • Zero trust network architecture
  • Third-party and vendor risk management tooling
  • Data loss prevention
  • Security awareness training
  • Incident response automation
  • Cloud security posture management
  • Encryption key management
各セットで最も良いもの・最も悪いものを選択最も良い:Highest priority最も悪い:Lowest priority
Q09
AIインタビュー

Identify the single most significant unresolved security or compliance risk this vendor is carrying right now — not the strongest area, the weakest one. If they reported an incident, get specifics on what happened, what changed afterward, and whether the fix was verified or just promised. If they claimed 'not sure' or 'not implemented' on any control, probe why and what would need to happen for it to close. Push past reassurance ('we take security seriously') to concrete evidence.

Q10
自由回答（長文）

Are there any planned improvements to your security program in the next 12 months we should know about (e.g., new certifications, tooling, staffing)?

Q11
選択式

What is your role in relation to this vendor's security or compliance program?

  • Security / InfoSec lead
  • Compliance or legal
  • Engineering or IT leadership
  • Executive / founder
  • Sales or account management
  • Other
  • Prefer not to say
Q12
選択式

How many employees does your organization have?

  • 1-50
  • 51-250
  • 251-1,000
  • 1,001-5,000
  • More than 5,000
  • Prefer not to say
Q13
メッセージ

Thank you for completing this assessment. Your responses will be reviewed by our security and procurement team as part of our vendor risk evaluation, and we may follow up with clarifying questions before finalizing our decision.

含まれる機能

  • AIによる深掘り

    自由回答に合わせてAIが追加で質問し、固定のフォームでは拾えない具体的な内容を引き出します。

  • 注意確認設問

    急いだ回答や質の低い回答者を除外する仕組みを標準で備えています。

  • AIが作成する設問文

    文言、設問の順序、条件分岐をAIが調査の目的に合わせて作成します。

  • 自動レポート

    回答が集まると、テーマ、引用、わかりやすい要約が自動で作成されます。

他ツールとの比較

ほかのアンケートツールで最も近いテンプレートを調べました。それぞれの優れている点と、このテンプレートがさらに踏み込んでいる点をまとめています。

このテンプレートを選ぶ理由

  • Instead of taking a vendor's checklist of certifications at face value, an AI follow-up interview probes the single most significant unresolved security or compliance risk in depth.
  • Combines structured data collection (certifications, encryption practices, a control-implementation matrix, incident history, subprocessor disclosure) with a MaxDiff on investment priorities and a confidence rating, giving procurement and security teams both breadth and depth.
  • Automated per-response quality scoring and an auto-generated report mean reviewers get a synthesized risk summary instead of a raw spreadsheet of answers to manually triage.
  • Transparent prompts let security and compliance teams see and audit exactly how the AI is probing vendors, supporting internal review and audit-trail requirements.

QuestionPro

Vendor Security and Assessment Sample Questionnaire Template

A directly comparable, ready-to-field vendor security questionnaire template covering certifications, controls, and data handling. It's a static question set aimed at the same procurement/security use case as ours, but relies entirely on pre-written questions with no mechanism to dig deeper on any single vendor response.

優れている点

  • Purpose-built for vendor security assessment, not a generic security form
  • Backed by QuestionPro's established survey logic and reporting tools
  • Likely customizable within their broader survey platform

物足りない点

  • No adaptive follow-up questioning — every vendor answers the same fixed checklist regardless of risk level
  • No indication of automated per-response risk scoring or a synthesized risk report
  • No published methodology for how or why any given question was included

SurveySparrow

Vendor Security Assessment Questionnaire Template

A fielding-ready vendor security assessment template aimed at the same audience as ours. It uses SurveySparrow's conversational chat-style survey format, which improves completion experience but is still a fixed question flow rather than a genuine investigative interview.

優れている点

  • Conversational, chat-like UI that may improve vendor response rates
  • Directly targeted at vendor security/risk assessment use case
  • Likely mobile-friendly given SurveySparrow's product focus

物足りない点

  • Conversational styling is not the same as adaptive AI reasoning — questions and branching are pre-set, not generated from the vendor's actual answers
  • No mention of automated risk scoring or an auto-generated compliance report
  • No voice-based interview option for vendors who prefer speaking to typing

Jotform

Cyber Security Risk Assessment Questionnaire Form Template

A general cyber security risk assessment form rather than a template specifically framed around evaluating a third-party vendor for procurement purposes; it's still close enough in subject matter to be a relevant comparison. It's a static form-builder template that vendors or organizations fill out once, with no interview-style follow-up.

優れている点

  • Easy to build and deploy quickly using Jotform's drag-and-drop form builder
  • Broad applicability across general cyber security risk scenarios
  • Can integrate with Jotform's wider forms/e-signature ecosystem

物足りない点

  • Framed as general cyber security risk assessment, not vendor-specific procurement review — teams would need to adapt it themselves
  • Purely a static form: no adaptive AI probing of unresolved risks and no automated scoring of response quality
  • No structured mechanism (like a control-implementation matrix or investment prioritization ranking) built specifically for vendor risk comparison

よくあるご質問

「Vendor Security and Risk Assessment Questionnaire」テンプレートにはどのような設問が含まれていますか？

すぐに使える設問が13問含まれており、最初の設問は次のとおりです：「Thanks for completing this security assessment on behalf of your organization. Your responses are completely confidentia…」・「Which of the following security certifications or attestations does your organization currently hold?」・「How is data belonging to your customers encrypted?」。すべての設問は上でプレビューでき、自由に編集できます。

このアンケートの回答にはどのくらい時間がかかりますか？

回答者は通常、13問を約7分で回答し終えます。

テンプレートは編集できますか？

はい。公開前であれば、すべての設問、選択肢、順序を編集できます。設問の追加や削除のほか、調査の目的に合わせた作り直しをAIエディターに依頼することもできます。

このテンプレートは無料で使えますか？

はい。エディターで開けば、すぐに編集を始められます。お試しにアカウントは不要で、無料プランでアンケートを公開できます。

公開の準備はできましたか？

このテンプレートをエディターで開いてみてください。最初の回答者が目にする前に、すべてを自由に変更できます。

このテンプレートを使う無料で始める

関連テンプレート

似たテーマのほかの調査もご覧ください。

すべて見る
Privacy & Compliance

Business Travel Data Consent & Comfort Survey

Assesses how well employees and business travelers understand, trust, and can withdraw consent for travel-related data collection like itinerary sharing, location tracking, and duty-of-care programs. Built for privacy, compliance, and travel program teams, with an AI follow-up that surfaces the real reasons behind any hesitation or discomfort.

テンプレートを見る
Privacy & Compliance

Vendor Security Questionnaire Workload & Automation Survey

Assess the workload burden, pain points, and automation readiness of teams handling vendor security questionnaires. Designed for security, GRC, procurement, and IT professionals to inform process improvement priorities.

テンプレートを見る
Privacy & Compliance

Vendor Performance Evaluation Survey

Assesses how a vendor or supplier is performing on quality, reliability, pricing, and support, and gauges internal appetite for renewal. Built for procurement teams and vendor managers running periodic supplier reviews, with an AI follow-up interview that digs into the specific incident or driver behind a respondent's satisfaction score instead of stopping at a number.

テンプレートを見る
Privacy & Compliance

Vendor Satisfaction and Performance Review Survey

Measures how a vendor performs on quality, delivery, pricing, and support, plus renewal intent and what factors matter most in the relationship. Built for procurement and operations teams running periodic vendor reviews, with an AI follow-up interview that digs into the specific incident behind a low or high score instead of leaving it as a number.

テンプレートを見る
Privacy & Compliance

New Vendor Request Justification Survey

For employees requesting to onboard a new vendor or supplier. Captures the business need, estimated spend, urgency, risk factors, and alternatives already considered so procurement and operations teams can triage requests quickly. The AI follow-up interview probes why existing approved vendors won't meet the need and surfaces risk details a form alone would miss.

テンプレートを見る
Privacy & Compliance

Supplier Service Performance Evaluation Survey

Gathers structured performance ratings and behavioral feedback on a supplier's delivery, quality, and responsiveness, for procurement and vendor management teams conducting periodic reviews. An AI follow-up interview digs into the specific incident behind the lowest-rated area so scorecards reflect what actually happened, not just a number.

テンプレートを見る