Free TPRM Templates, Checklists & Questionnaires

A practical security questionnaire covering governance, access control, encryption, network and endpoint security, secure development, logging, incident response and business continuity.

Question set built for scoring rather than box-ticking, with weighting guidance so answers convert directly into an inherent and residual risk rating.

Enterprise-grade third party assessment covering security, privacy, resilience, concentration risk, fourth parties, offshoring and regulatory obligations.

The general-purpose TPRM questionnaire: what to ask, why each question exists, and what an acceptable answer looks like for tier 1, tier 2 and tier 3 vendors.

Due diligence questionnaire spanning corporate identity, ownership, financial stability, compliance certifications, privacy posture and subcontracting.

Supply chain focused questionnaire for suppliers and manufacturers, including physical security, personnel screening, component provenance and OT or ICS exposure.

An educational guide to the Shared Assessments SIG framework. Learn what the Standardized Information Gathering questionnaire covers, how to scope it for a vendor review, and how to evaluate a completed SIG package. This is not an official SIG download.

An educational guide to SIG Lite, the shorter Shared Assessments questionnaire used for lower-risk or initial triage reviews. Understand when SIG Lite is sufficient, when to escalate to SIG Core, and how to interpret the results. This is not an official SIG download.

An educational guide to SIG Core, the most comprehensive Shared Assessments questionnaire scope for critical vendors handling regulated or sensitive data. Covers domain selection, evidence expectations, and review workflow. This is not an official SIG download.

The Consensus Assessments Initiative Questionnaire from the Cloud Security Alliance, mapped to the Cloud Controls Matrix, for assessing cloud and SaaS providers.

The condensed CAIQ used for faster cloud vendor triage, plus what coverage you give up compared with the full CAIQ.

The Higher Education Community Vendor Assessment Toolkit, including HECVAT Full and Lite usage, accessibility questions and the community broker model.

The Vendor Security Alliance questionnaire, a lean and opinionated assessment favoured by technology companies that want signal over volume.

Free Excel questionnaire for assessing AI and GenAI vendors: model provenance, training data usage, prompt and output retention, human oversight, bias testing, hallucination handling and sub-model providers.

A side-by-side breakdown of the fifteen questionnaires real programmes rely on, what each is best at, how long each takes a vendor, and which vendor tier each suits.

Questions the outgoing vendor signs to confirm your data is deleted and access is gone. Use it when: You need written proof from the vendor at exit.

How the vendor controls logins, MFA, admin accounts and access reviews. Use it when: The vendor will hold admin or privileged access.

Whether the vendor logs activity, detects attacks and keeps records long enough. Use it when: You need to know if a breach at the vendor would be spotted.

How fast the vendor finds and fixes security weaknesses. Use it when: The vendor runs internet-facing systems that touch your data.

Whether the vendor has a tested plan and will tell you quickly when something goes wrong. Use it when: You need breach notification you can rely on.

Backups, recovery times and ransomware readiness at the vendor. Use it when: Your operations stop if this vendor goes down.

How vendor staff connect into your network and how that access is controlled. Use it when: A vendor needs VPN, jump host or remote support access.

How the vendor builds and secures its software, including a software bill of materials. Use it when: You install or depend on the vendor's software.

Which subcontractors your vendor relies on and how it manages their risk. Use it when: Your data passes on to your vendor's own suppliers.

Questions that help estimate the money you could lose if this vendor is breached. Use it when: Leadership wants vendor risk in financial terms.

API security, authentication and data flows for fintech and banking integrations. Use it when: A fintech partner connects to your systems by API.

PCI DSS evidence and card data controls for payment providers. Use it when: The vendor stores, processes or transmits card data.

How a healthcare vendor protects electronic patient health information. Use it when: The vendor handles patient data (HIPAA scope).

Security, resilience and shared responsibility for IaaS and cloud hosting providers. Use it when: You host workloads or data with a cloud provider.

Controls for managed service and managed security providers that hold broad access. Use it when: An outsourced IT or security provider manages your environment.

A right-sized questionnaire for young vendors who do not have a SOC 2 report yet. Use it when: A startup vendor cannot share a SOC 2 or ISO certificate.

Processor obligations, data transfers, sub-processors and data subject rights under GDPR. Use it when: The vendor processes personal data of people in the EU or UK.