Questionnaires and Evidence Required for the Assessment
What to ask a vendor for in order to assess it
A well-designed security questionnaire makes it possible to collect structured information about a vendor's controls (security policies, access management, encryption, incident response and business continuity), but its value depends on requiring concrete evidence and not just self-declared answers, since a vendor may answer yes to questions about controls it doesn't consistently apply in practice. Requesting evidence such as current certifications, independent audit reports, recent penetration test results or documented internal policies makes it possible to compare what's declared with what's verifiable. Adapting the questionnaire to the type of service is also important: the relevant questions for a cloud infrastructure provider differ from those for a cleaning company with physical access to offices, and using a generic questionnaire for both produces superficial assessments that don't capture the specific risk of each relationship.