← All templates
General Security Baseline
A vendor-agnostic baseline security questionnaire covering essential controls for any third-party vendor.
22 questions·Version 1.0
Basic Security
- Do you have a documented information security policy?GS-1
- Do you enforce strong password policies across all systems?GS-2
- Do you use multi-factor authentication for critical systems?GS-3
- Do you keep all software and systems patched and up to date?GS-4
- Do you use antivirus or endpoint protection on all devices?GS-5
Data Protection
- Do you encrypt sensitive data at rest and in transit?GS-6
- Do you have a data backup process in place?GS-7
- Do you have a documented data retention and disposal policy?GS-8
Access Control
- Is access to systems granted on a least-privilege basis?GS-9
- Do you review and revoke access when employees leave?GS-10
Incident Response
- Do you have an incident response plan?GS-11
- Can you notify affected customers of a security breach?GS-12
Physical Security
- Do you have physical access controls for office and server locations?GS-13
Compliance
- Do you have any active security certifications (SOC 2, ISO 27001, etc.)?GS-14
- Have you experienced any security breaches in the last 12 months?GS-15
- Do you conduct annual security training for all employees?GS-16
- Do you have cyber insurance coverage?GS-17
Third Parties
- Do you assess the security of your critical suppliers?GS-18
- Do you have contracts with security requirements for all critical suppliers?GS-19
General
- What security frameworks or standards does your organisation follow?GS-20
- When was your last external security audit or assessment?GS-21
- Please share any relevant security certifications or reports.GS-22
Send this questionnaire to your vendors
VendorAuditly automatically scores responses, maps answers to framework controls, and tracks coverage over time. Free to start.