Establishing secure connection…Loading editor…Preparing document…

Cyber Security Questionnaire

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

CYBER SECURITY QUESTIONNAIRE AND SERVICES AGREEMENT

This Cyber Security Questionnaire and Services Agreement (the Agreement) is entered into as of by and between Service Provider Name: and Client Name: .

WHEREAS

WHEREAS, Service Provider provides cyber security services, assessments and advisory support, and Client seeks to evaluate and improve its information security posture; and

WHEREAS, the parties wish to record the scope of services, payment, confidentiality obligations and the responses to a detailed cyber security questionnaire that will inform any assessment, remediation or monitoring work performed under this Agreement; and

WHEREAS, the parties intend that the responses provided in the Cyber Security Questionnaire be relied upon by Service Provider in planning and executing assessments, and by Client as a formal record of the current security controls and practices.

SCOPE OF WORK

CYBER SECURITY QUESTIONNAIRE

1. Governance & Policy

Does the organization maintain a formal information security policy?

2. Incident Response

Incidence response plan in place:

3. Access Control

Multi-factor authentication enforced for remote or privileged access:

4. Technical Controls

Perimeter firewall or equivalent in place:

Endpoint protection (AV/EDR) deployed on endpoints:

Encryption of sensitive data at rest:

Encryption in transit (TLS or equivalent):

5. Vulnerability Management

Formal patch management policy in place:

External penetration test performed within last 12 months:

6. Third-Party Risk Management

Vendor security assessments performed for critical suppliers:

Are subcontractors or third-party cloud providers used to process Client data:

7. Business Continuity & Disaster Recovery

Business continuity / disaster recovery plan exists:

8. Compliance & Certifications

9. Data Handling

10. Security Metrics & Reporting

PAYMENT TERMS

Service fees for the scope of work shall be:

TERM AND TERMINATION

Agreement term begins on and ends on unless earlier terminated as provided below.

Either party may terminate for material breach if the breach remains uncured for the notice period specified above. Termination for cause shall not relieve the breaching party of liability for amounts accrued prior to termination or for direct damages resulting from the breach.

CONFIDENTIALITY

Each party acknowledges that in connection with this Agreement it may receive Confidential Information of the other party. Confidential Information means non-public business, technical or financial information disclosed in any form that is designated confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. Confidential Information excludes information that is (a) already known to the recipient without restriction at the time of disclosure; (b) publicly available through no wrongful act of the recipient; (c) rightfully received from a third party without restriction; or (d) independently developed by the recipient without use of the discloser's Confidential Information.

The recipient shall (i) use Confidential Information only for performance under this Agreement; (ii) protect Confidential Information with at least the same degree of care it uses to protect its own confidential information, but in no event less than reasonable care; and (iii) not disclose Confidential Information to any third party except employees, contractors or professional advisors who have a need to know and who are bound by confidentiality obligations at least as protective as those in this Agreement. Upon termination or upon written request, the recipient shall return or destroy the discloser's Confidential Information and certify in writing that it has done so.

Notwithstanding the foregoing, the recipient may disclose Confidential Information to the extent required by law, regulation or valid legal process, provided the recipient provides prompt written notice to the discloser to allow the discloser to seek protective measures, unless prohibited by law.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the state of without regard to conflicts of law principles. The parties consent to the exclusive jurisdiction of the state and federal courts located in that state for all disputes arising under this Agreement.

ENTIRE AGREEMENT

This Agreement, including the Cyber Security Questionnaire responses completed herein and any attachments or statements of work executed by the parties, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior and contemporaneous agreements, proposals or representations, whether written or oral. Any amendment must be in writing and signed by authorized representatives of both parties.

REPRESENTATION AND CERTIFICATION

The undersigned certify that the answers and statements provided in this Cyber Security Questionnaire are true, complete and accurate to the best of their knowledge as of the date of signature, and acknowledge that Service Provider may rely on these statements in performing services under this Agreement.

Service Provider:

By:

Date:

Client:

By:

Date:

Enter text✕
Prepare your document for signing right on this page
  • 01 Edit the text and complete the fields
  • 02 Click Sign Now and on the next screen add recipients and signature fields in SignNow
  • 03 Start your free trial to sign and send your doc
Sign Now

What the Cyber Security Questionnaire Is and Why It Exists

A Cyber Security Questionnaire is a structured assessment used to collect consistent information about an organization’s security posture, controls, and third-party risk. It typically covers governance, technical controls, incident response, data handling, and compliance. Organizations use these questionnaires for vendor risk review, procurement due diligence, regulatory reporting, and internal audits to compare responses against baseline requirements and contractual obligations.

Why a Standardized Questionnaire Helps Risk Decisions

A consistent Cyber Security Questionnaire reduces ambiguity, speeds vendor assessments, and produces auditable records useful for contract negotiations and regulatory reviews. Clear answers enable risk scoring and remediation planning while supporting evidence-based decisions without repeated ad hoc requests.

Why a Standardized Questionnaire Helps Risk Decisions

Who Typically Completes or Reviews These Questionnaires

Organizations assign questionnaires to vendor security teams, internal IT/security groups, and procurement or legal reviewers depending on context and risk level.

  • IT or Security Team: Completes technical and architecture sections, provides evidence attachments and control descriptions.
  • Vendor Risk or Procurement: Manages distribution, scoring, and conditional follow-ups for high-risk suppliers.
  • Legal or Compliance: Reviews attestations, contractual language, and regulatory statements for accuracy.

Responses are then reviewed by stakeholders who decide whether to accept, remediate, or decline based on the documented controls and evidence.

Primary Roles Who Sign or Authorize Responses

CISO

Chief Information Security Officers often review and sign high-level attestations about governance, incident response readiness, and risk posture. Their signature indicates organizational accountability and links questionnaire statements to executive oversight and budget authority.

Vendor Sec Lead

The vendor security or compliance lead completes technical responses, attaches evidence, and certifies accuracy. This signer is usually responsible for day-to-day controls and coordinates evidence collection from engineering or operations teams.

Key Information Fields the Questionnaire Should Capture

Organization: Legal entity name
Contact: Primary security contact
Assessment Period: Date range covered
Systems Inventory: Major systems listed
Policies: Key security policies
Third Parties: Subcontractor list

Step-by-Step: Completing the Cyber Security Questionnaire

Follow these steps to prepare, complete, and submit a consistent and defensible questionnaire response.

  • 01
    Gather Documents: Collect policies, network diagrams, and audit reports.
  • 02
    Assign Roles: Identify who fills each section and attaches evidence.
  • 03
    Complete Fields: Answer clearly; use standard formats and attach files.
  • 04
    Review and Sign: Legal or security signs to certify accuracy.

Recommended Online Workflow Settings for Efficiency

Configure the online questionnaire to reduce friction and ensure consistent routing and evidence collection.

Field Configuration
Authentication Method Email link plus optional SMS code
Conditional Sections Show vendor-specific sections when third-party=true
Attachment Requirement Enforce PDF uploads for proof fields
Audit Trail Settings Enable full timestamps and IP logging

Typical Distribution and Response Flow

A standard digital flow minimizes back-and-forth and preserves an evidentiary audit trail.

  • Initiate: Requester configures questions and routing.
  • Send: Questionnaire emailed or link provided.
  • Respond: Vendor completes fields and uploads evidence.
  • Review: Reviewer scores answers and records decision.

Technical Requirements and Integrations to Support eSubmission

Ensure the platform supports required authentication, audit trails, secure attachments, and integration with procurement or GRC systems.

  • Authentication Options: Email, SMS, or SSO
  • File Formats: PDF, DOCX, CSV accepted
  • Integrations: Salesforce, NetSuite, Google Workspace

Confirm the platform meets your compliance needs (HIPAA, SOC 2) and retains tamper-evident logs for audit and legal review.

Typical eSignature Pricing and Compliance Comparison

Core pricing and compliance features for common eSignature vendors; signNow appears first for reference and column parity.

signNow DocuSign Adobe Sign PandaDoc HelloSign
Starting Price $8/user/mo $15/user/mo $14/user/mo $19/user/mo $15/user/mo
Free Trial 7-day free trial Varies Varies Varies Varies
Bulk Send Yes Yes Yes Yes No
Audit Trail Yes Yes Yes Yes Yes
HIPAA Compliant Yes Yes Yes No No

Real-World Examples of Questionnaire Use

Two representative examples show how organizations use structured questionnaires to collect vendor security data and speed decisions.

Optica Ventures LLC

Optica needed a single standard assessment for all vendors to reduce repeated requests and inconsistency.

  • "The interface is simple and easy-to-use for our team; more importantly, it is just as easy for our customers."
  • Standardized responses reduced follow-ups and improved review turnaround while preserving audit records for procurement and compliance teams.

Martin Properties

A real estate operator required uniform vendor security attestations across properties and tenants.

  • "I can process and execute all of these documents online with 100% compliance and built-in security."
  • Using a digital questionnaire enabled centralized tracking, faster contract execution, and clear evidence for audits and insurance underwriting.

Practical Tips to Improve Accuracy and Speed

Adopt standard templates, define evidence expectations, and use role-based routing to reduce errors and accelerate reviews.

Use a Standard Template
Maintain a centrally approved questionnaire template and update annually. This ensures comparability across vendors and reduces reviewer confusion about missing fields.
Require Evidence Samples
Specify acceptable evidence formats for each control (policy, screenshot, log excerpt). Clear requirements reduce back-and-forth and shorten review cycles.
Apply Conditional Logic
Show only relevant sections based on vendor scope. Conditional sections reduce respondent burden and improve completion rates.
Preserve an Audit Trail
Capture timestamps, IP, and signer attribution to support legal defensibility and internal audits in case of dispute or incident.

Common Mistakes That Delay Reviews

  • Providing expired reports or evidence that do not match the assessment period, causing reviewers to request updated documentation and re-open the assessment.
  • Leaving conditional sections blank rather than marking them Not Applicable, which triggers additional clarification requests and slows scoring.
  • Submitting redacted evidence without a statement of what was redacted, preventing reviewers from validating controls and increasing remediation requests.
  • Using vague answers like 'we have reasonable security' instead of specific controls, tool names, or configurations that reviewers can verify.

Risks and Consequences of Inaccurate or Omitted Responses

Contract Termination: Loss of business
Regulatory Fines: Possible enforcement penalties
Data Breach Costs: Remediation and notification
Insurance Issues: Coverage disputes
Delayed Onboarding: Project start holds
Legal Liability: Breach of warranty or misrepresentation

Essential Sections of a Professional Cyber Security Questionnaire

A complete questionnaire covers governance, technical controls, third-party relationships, incident readiness, compliance attestations, and evidence attachments.

Governance

Questions on security policy, leadership oversight, risk assessments, and training programs to establish organizational accountability and policy enforcement.

Technical Controls

Inventory of network, endpoint, and application controls including patching, encryption, access control, and monitoring technologies in use.

Incident Response

Procedures, playbooks, and retention of incident records; expected notification timelines and escalation paths for security events.

Third-Party Risk

Subprocessor lists, contractual security requirements, and evidence of vendor assessments or penetration tests for outsourced services.

Compliance

Attestations for applicable frameworks such as HIPAA, PCI, SOC 2, and any regulatory certifications the organization maintains.

Evidence

Required attachments such as policies, audit reports, architecture diagrams, and sample logs to substantiate narrative answers.

How to Save and Export Questionnaire Responses

Provide multiple export options so reviewers and auditors can access responses in their preferred format while preserving metadata.

Export to PDF

Generate a PDF that includes answers, attachments, and an audit trail. Use PDF/A for long-term archiving and legal retention needs.

Download DOCX

Export an editable DOCX copy when reviewers need to annotate or insert comments prior to finalizing records and approvals.

CSV Data Export

Export answers and metadata as CSV for ingestion into GRC or vendor-risk management tools for scoring and reporting.

Signed Record

Produce a finalized, signed PDF with timestamp and certificate of completion to serve as the authoritative record of attestations.

Frequently Asked Questions About the Cyber Security Questionnaire

Answers to common questions on legality, required fields, sensitive data handling, and digital submission options.


Need help? Contact support

be ready to get more
Join over 28 million airSlate SignNow users
Sign Now
Company
Forms
Pricing
Resources
Knowledge base
Other Products
© 2026 airSlate Inc. All rights reserved.