vendor-security-assessment

name	vendor-security-assessment
title	Vendor Security Assessment Questionnaire
description	Drafts a Vendor Security Assessment Questionnaire evaluating third-party cybersecurity posture, data handling, and regulatory compliance. Vendor responses become binding contractual representations with executive certification. Use during vendor due diligence, third-party risk management, procurement security review, or subprocessor evaluation.
author	CaseMark
author_url	https://github.com/CaseMark/skills/tree/main/skills/legal/vendor-security-assessment
license	Apache-2.0
version	0.1.0
execution_mode	open
jurisdiction	general
practice	cybersecurity
language	en

Vendor Security Assessment Questionnaire

Generates a pre-contract due-diligence questionnaire for evaluating vendor security controls, data practices, and compliance across GDPR, CCPA, HIPAA, SOX, GLBA, FERPA, and industry frameworks.

Quick Start

Gather before drafting:

1. Vendor scope — data types accessed (PII, PHI, PCI, financial, proprietary), processing activities, data flows
2. Applicable regulations — GDPR, CCPA, HIPAA, SOX, GLBA, FERPA, or sector-specific
3. Risk tolerance — what constitutes acceptable vs. disqualifying vendor risk
4. Contract alignment — security provisions to incorporate by reference

Document Framework

Element	Requirement
Preamble	Completion mandatory pre-contract; responses are binding representations
Executive certification	Senior officer (CISO/CTO/CLO) attests accuracy; signature block required
Submission deadline	10–15 business days
Change notification	Vendor notifies within 5 business days of material security changes
Confidentiality	Questionnaire and responses treated as confidential business information

Assessment Domains

Draft numbered questions per domain. Each question includes a response field and evidence-request field where applicable. Tailor scope to data sensitivity — not every vendor needs every domain.

1. Information Security Governance

• Dedicated CISO/equivalent; certifications (CISSP, CISM, CISA)
• Framework alignment (NIST CSF, ISO 27001, CIS Controls, COBIT)
• Policy review cadence; security awareness training (all-staff + specialized)
• Board-level security reporting frequency

2. Data Classification & Lifecycle

• Classification taxonomy compatibility with client's scheme
• All data storage/processing locations (primary, DR, backup, cloud regions)
• Cross-border transfer mechanisms (SCCs, adequacy decisions, BCRs)
• Retention post-termination; destruction methods; certificates of destruction
• Backup frequency; encrypted backup media; tested RTO/RPO

3. Access Control & Privileged Access

• MFA enforcement across all access; supported factors
• RBAC, least-privilege, segregation of duties