Vendor compliance questionnaire
templates

Start from the obligation, not the framework name. The template should match whoever is asking you to prove vendor oversight: a regulator, an auditor or an enterprise customer.

• General security: the default for any supplier that touches your systems or data and isn't covered by a specific rule.
• GDPR: any vendor that processes personal data for you. Covers the Article 28 processor checks: DPA, sub-processors, transfers, breach notice.
• SOC 2: you are going through SOC 2 yourself and your auditor will test how you oversee vendors.
• ISO 27001: you hold or are working towards ISO 27001 and need evidence for the supplier relationship controls in Annex A.
• DORA: you are an EU financial entity, or an ICT provider to one, and need Article 28 third-party due diligence.
• NIS2: you are an essential or important entity in the EU, or supply one, and need supply chain security evidence.
• PCI DSS: the vendor stores, processes or can affect the security of cardholder data.
• AI governance: the vendor uses AI on your data or in the service it provides, including AI features inside ordinary SaaS.

Not sure how much to ask a given vendor? The free questionnaire builder sizes a questionnaire to the vendor’s risk, and the DORA and NIS2 scope checker tells you whether those rules apply to you at all. Sending a 45-control SOC 2 questionnaire to a low-risk supplier mostly produces late, copy-pasted answers.