Company identity
Legal name, DBA, EIN, corporate address, primary contact, and corporate structure for verification and tax purposes.
A well-prepared Business Services SDQ provides consistent data for vendor selection, reduces follow-up questions, and documents risk controls that feed contract terms and audits.
Different teams interact with the SDQ at separate stages of procurement and oversight.
Cross-functional review of SDQ responses reduces negotiation cycles and supports auditability across finance, legal, and IT.
Legal name, DBA, EIN, corporate address, primary contact, and corporate structure for verification and tax purposes.
Detailed description of services offered, deliverables, hours of operation, geographic coverage, and any subcontracted activities.
Information on encryption, access control, vulnerability management, incident response, and certifications such as SOC 2 or ISO 27001.
Regulatory status including HIPAA, FERPA, PCI, data residency, and whether the vendor will sign a BAA where required.
Disaster recovery plans, recovery time objectives, backup frequency, and recent DR test results.
General liability, cyber liability, limits, and certificate of insurance details that affect contract risk allocation.
| Field | Configuration |
|---|---|
| Authentication | Email link | SMS code | KBA |
| Attachments | Require evidence uploads (PDF, DOCX) |
| Conditional Questions | Show only when relevant to reduce friction |
| Audit Trail | Enable timestamps, IP, and action logs |
Choose secure delivery and storage channels aligned with your security policy and procurement systems.
Ensure chosen channels support required encryption, evidence retention, and integration with procurement or contract management systems.
Commonly 7–14 calendar days depending on complexity.
Allow 3–7 business days for security and legal checks.
Send clarifying questions within 48–72 hours of initial review.
Typically within 5 business days after all evidence is provided.
Sign within agreed procurement SLA once SDQ conditions met.
Optica required a standardized SDQ for all service providers to reduce onboarding time
Xerox integrated SDQ responses with NetSuite for automated vendor records
| Form Type | Business Services SDQ | Vendor Risk Assessment |
|---|---|---|
| Purpose | operational details | deep security testing |
| Typical length | 10–30 pages | 30+ pages |
| Attachments | insurance, policies | audit reports, penetration tests |
| Use case | contract scoping | in-depth vendor validation |
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | Yes, 7-day free trial | Varies by plan | Varies by plan | Varies by plan | Varies by plan |
| Bulk Send | Yes (Business Premium) | Plan-dependent | Plan-dependent | Plan-dependent | Plan-dependent |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |
| Envelope Cap | No cap | 100 envelopes/user/year | Plan-dependent | Plan-dependent | Plan-dependent |