The 19 Documents Vendor Questionnaires Actually Ask For, Ranked by How Much Work They Save
- Vendor questionnaires
- Evidence
- Procurement
- Checklist
Vendor questionnaires vary enormously in format and barely at all in substance. Every procurement team writes their own, and then asks more or less the same things as the last one. Which means the work is not really answering questions. It is finding nineteen documents, once.
Five of the nineteen do a third of the work
The counts below are typical rather than measured, and they move with the questionnaire. But the shape holds: coverage is lopsided, and treating the list as nineteen equal chores is the reason people give up on it a third of the way through.
The thirteen
Information security policy
Your top-level statement of how the company protects information. It answers more questions than anything else because it is the one place encryption, access control, asset management and security governance all appear together. If you write one document this quarter, write this one.Access control policy
Who can reach what, and how that is granted, reviewed and revoked. Access questions are the most repetitive part of a security section, and they are unusually specific: MFA coverage, least privilege, the joiner-mover-leaver process, how often access is reviewed. Vague answers here get followed up more than anywhere else.Data protection and privacy policy
How personal data is handled, where it lives, and on what legal basis. Expect GDPR questions, data residency, retention periods and data subject rights. Residency is the one that stalls deals: buyers want a straight answer about which country the data sits in, and "the cloud" is not one.Business continuity and disaster recovery
What happens when something breaks and how quickly you recover. The questions want numbers: recovery time and recovery point objectives, backup arrangements, failover, and how often you have tested it. The last one is where most answers weaken, because plenty of companies have a plan and no record of ever running it.System architecture overview
How the product is built and hosted: hosting, data flows, network segregation, separation of environments. This one is usually the least work to produce, because a version of it already exists in your onboarding docs and only needs tidying for an external reader.Security certification
ISO 27001, SOC 2, Cyber Essentials or equivalent, meaning the certificate itself rather than a claim about it. It lets a buyer skip entire sections, which is why it is worth attaching early. Watch the scope: a certificate covering a subsidiary or one product line answers less than people assume.Product or service description
What you actually sell, what it is made of and who uses it. Nearly every questionnaire opens with it, and it is nearly always answered from scratch by hand, because the material lives on a website rather than in a document anybody thinks to file. Your own product or use-cases page says it better than anything internal, so read it off there rather than writing it again.Incident response plan
How you detect, handle and report an incident. The question buyers really care about is notification: how fast you will tell them, and who makes that call. A plan that does not commit to a timescale leaves the most important question on the form unanswered.Physical security policy
How your offices and the places your people work are controlled, and who is screened. Remote-first companies get asked this as often as anybody, and "we have no office" is a perfectly good answer that still has to be written down once. One large manufacturer's assessment puts seven questions here, including a request for the policy itself.Sub-processor list
The third parties that process data on your behalf, what they do and where they are. This is the entry most often out of date, because the list changes whenever engineering adopts a tool and nothing in that process prompts anyone to update a legal annex.HR security and screening
Background checks, onboarding, confidentiality agreements and security awareness training. Straightforward to answer and frequently missed, because the security section is sent to the security person and this part of it does not belong to them.ESG position or report
Carbon reporting, modern slavery, diversity and inclusion, supplier ethics. The fastest growing section of the modern questionnaire and the one small companies are least ready for. If you hold EcoVadis, B Corp or ISO 14001, the certificate is the quickest thing to reach for.Terms and conditions
Your standard terms: what you commit to, what you are liable for, how either side gets out. Procurement asks for these before security does, and the version on your website is almost always the one they want. The only document here a buyer may read line by line.Secure development practices
How code is written, reviewed and released: peer review, release approval, change control, how quickly you patch. Buyers ask for this by name, and a short written statement of how code reaches production answers it. It does not need to be a formal policy, which is why so few companies have one to attach.Penetration test summary
An independent test of your systems: the summary or attestation letter, not the full findings. Questions cover frequency, scope, who performed it and how findings were remediated. Remediation is the part reviewers actually read, so a test with open criticals and no follow-up is worse than none.Third-party and supplier risk
How you assess and monitor your own suppliers. There is a certain symmetry to being asked this in a vendor questionnaire, and it is genuinely the point: your buyer inherits your supply chain, so they want to know you apply to others roughly what is being applied to you.Asset management and disposal
What equipment and data you hold, how it is classified, and how it is destroyed. The question nobody has a document for is the one about drives: what happens to a laptop when somebody leaves. A page covering what you track and how a device is wiped answers most of the section.Insurance schedule
Cyber liability and professional indemnity cover with limits, insurer and policy period. The least interesting document on the list and among the easiest to obtain, since your broker can send it the same day. Check the limits against the contract, because procurement sometimes specifies a minimum.Cookie policy
What your site puts on a visitor's device, and how consent is taken and withdrawn. Few questions, and they arrive in the privacy section where a thin answer looks like a thin privacy programme. It is a page on your own site, so it costs nothing to add.
The expensive ones are the unowned ones
Read back through that list and notice how many owners are described as "whoever". That is not vagueness for its own sake. In a company under a couple of hundred people, several of these documents genuinely have no owner, and that is what makes them expensive.
A document nobody owns is not missing in a way anyone notices. It is missing on the Thursday a deal is waiting on it.
The hard ones are not the technically difficult ones. Architecture overviews are easy and usually half written already. What hurts is the sub-processor list that went stale, the ESG position nobody was ever asked for, and the business continuity plan that exists but has never been tested, because each of those requires a decision from someone who did not know they were on the hook.
What to do about the ones you do not have
Answer honestly and say what you do instead. Buyers are far more tolerant of a stated gap with a compensating control than of a confident claim that collapses under the follow-up question, and follow-up questions are where a questionnaire turns into a call.
There is also an order of operations worth respecting. Do not start writing policy in response to a live questionnaire: a policy written that week to answer a question is transparently that, and it commits you to something you have not thought about. Answer what is true now, note what is planned, and write the document properly afterwards.
Find them once
The reason to treat this as a list rather than a project is that the second questionnaire should cost a fraction of the first. The documents do not change between buyers. The questions barely change. What changes is the format, and reformatting is the part software should be doing.
So gather the top five, answer what they support, and let the rest accumulate as they come up. A partial library is not a partial result: it is roughly half of every questionnaire you will be sent, permanently.
Frequently asked questions
- What documents do you need for a vendor security questionnaire?
- In practice a small set does most of the work: an information security policy, an access control policy, a data protection policy, a business continuity and disaster recovery plan, and an architecture overview. Beyond those, a security certification, an incident response plan, a sub-processor list, HR screening evidence, an ESG position, a penetration test summary, a supplier risk policy and an insurance schedule cover most of what remains.
- Which document answers the most questionnaire questions?
- The information security policy, because it is the one document that touches encryption, access control, asset management and security governance in a single place. An access control policy is close behind, since access questions are the most repetitive part of most security sections.
- Do you need ISO 27001 or SOC 2 to answer a vendor questionnaire?
- No. A certification shortens the conversation and lets a buyer skip whole sections, but its absence is not a blocker. What you cannot do is leave the underlying questions unanswered: if you hold no certificate, the policies and evidence behind it have to answer for themselves.
- What if a document does not exist yet?
- Say so plainly and say what you do instead. Buyers read an honest gap with a compensating control far better than a vague claim that does not survive follow-up, and a questionnaire answered with something unverifiable is worse than one answered with a candid no.
- How often do these documents need updating?
- Annually for most policies, and immediately after anything they describe changes. The dated ones matter more: certificates, penetration test summaries and insurance schedules all carry expiry, and an expired certificate attached to an otherwise strong answer is the kind of detail a reviewer notices.
- Do you have to send the documents themselves?
- Often not. Many questionnaires want an answer with the document available on request, and some sections are satisfied by a policy summary rather than the full text. Assembling them is still worth doing, because the answers come out of them either way.