Are electronic responses legally binding?

Yes. Electronic signatures and records are legally enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted, provided intent, consent, attribution, and retention criteria are met.

When is a BAA required?

A Business Associate Agreement is required when the supplier will create, receive, maintain, or transmit protected health information (PHI) under HIPAA; include it before exchanging PHI.

What evidence should accompany answers?

Attach redacted SOC 2 or ISO reports, penetration test summaries, network diagrams, and policy documents that correspond directly to questionnaire answers to avoid follow-up.

Who can sign the completed questionnaire?

An authorized officer or designated security contact should sign; contract terms may require sign-off by a corporate officer—verify signer authority with the buyer before submission.

Is remote notarization needed?

Not typically for security questionnaires. Use RON only if the buyer explicitly requires notarized attestations; verify state RON rules if used.

How long should answers and evidence be retained?

Retain for the duration of the contract plus an appropriate post-termination period; federal and industry rules may require specific minimums such as IRS or HIPAA retention periods.

Electronic Signature
Templates
Miscellaneous
Supplier Information Security Questionnaire

Supplier Information Security Questionnaire

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

SUPPLIER INFORMATION SECURITY QUESTIONNAIRE AND AGREEMENT

Parties and Recitals

This Supplier Information Security Questionnaire and Agreement (the "Agreement") is entered into by and between:

Client Name: Supplier Name:

WHEREAS, Client requires that suppliers handling Client data or connecting to Client systems demonstrate and maintain specified information security controls; and

WHEREAS, Supplier represents that it has implemented an information security program commensurate with the sensitivity of data and services provided and agrees to complete this Questionnaire and comply with the requirements set forth herein; and

WHEREAS, the parties intend for this Questionnaire, together with the contractual terms herein, to govern security obligations applicable to Supplier's provision of services to Client.

Scope of Work

Describe services, systems, or deliverables that are subject to this Agreement

Supplier Contact and Organization Information

Primary Contact Name Primary Contact Title Primary Contact Email Business Address

Security Program and Governance

Does Supplier maintain a formal, documented information security program? Yes No

Security Policy Location or Reference (describe)

Last third-party security assessment or audit type: Date:

Is Supplier ISO/IEC 27001 certified? Yes No If yes, certificate issue date:

Data Handling, Access, and Encryption

Types of Client Data Processed or Stored

Encryption at rest: Yes No Encryption in transit: Yes No

Describe encryption algorithms, key management practices, and key custodianship

Incident Response and Notification

Does Supplier maintain an Incident Response Plan? Yes No

Incident reporting contact and 24/7 phone or email

Supplier agrees to notify Client of any confirmed or reasonably suspected security incident affecting Client data no later than hours from discovery.

Vulnerability Management and Testing

Patch management frequency: Penetration testing frequency:

Does Supplier remediate critical vulnerabilities within 30 days? Yes No

Subcontractors and Third Parties

Will Supplier engage subcontractors or subprocessors that will access Client data? Yes No

If yes, list subprocessors, third-party assessments performed, and contractual controls

Business Continuity and Disaster Recovery

Recovery Time Objective (RTO): Recovery Point Objective (RPO):

Date of most recent DR test: Test summary (key outcomes):

Insurance and Liability

Does Supplier maintain cyber liability insurance? Yes No

If yes, policy limits and insurer name

Representations, Payment, Term and Termination

Payment Terms:

Total Fee or Estimated Fee Payment Schedule

Late payment interest or fee:

Term: This Agreement commences on and continues until unless earlier terminated in accordance with its terms.

Either party may terminate this Agreement for convenience upon days' prior written notice. Either party may terminate immediately for material breach that remains uncured after 30 days' notice.

Confidentiality

Supplier shall maintain confidentiality of Client Confidential Information and shall not use or disclose such information except to perform the Services or as required by law. Supplier shall implement industry-standard administrative, technical and physical safeguards to protect Client Confidential Information against unauthorized access, use, disclosure, alteration, or destruction.

Supplier acknowledges that a breach of confidentiality may cause irreparable harm to Client and agrees that Client may seek injunctive relief in addition to any other remedies available at law or equity.

Supplier confirms that access to Client Confidential Information will be limited to personnel with a business need-to-know and that background checks and confidentiality agreements are in place where appropriate. Supplier acknowledges and agrees

Audit Rights and Compliance

Client reserves the right to request documentation or evidence reasonably necessary to verify Supplier compliance with the security requirements set forth in this Questionnaire. Supplier shall cooperate in good faith with reasonable audit requests subject to protection of Supplier confidential information and commercially sensitive details.

Applicable laws and certifications relevant to Services:

Representations and Warranties

Supplier represents and warrants that (i) the information provided in this Questionnaire is true, complete and accurate as of the date signed below; (ii) Supplier maintains commercially reasonable security practices and procedures; and (iii) Supplier will promptly notify Client of any material change to the information provided herein.

Governing Law; Entire Agreement

Governing Law: This Agreement shall be governed by and construed in accordance with the laws of the state of , without regard to conflict of laws principles.

Entire Agreement: This Questionnaire together with any referenced statements of work and the parties' underlying services agreement constitute the entire agreement between the parties with respect to the subject matter hereof and supersede all prior and contemporaneous agreements and understandings, whether written or oral.

Certification

By signing below, Supplier certifies that the answers, statements and attachments provided in this Questionnaire are true and accurate to the best of Supplier's knowledge, and that Supplier agrees to comply with the obligations set forth in this document. Supplier further agrees to notify Client promptly of material changes to security posture or any security incidents impacting Client data.

Supplier:

By:

Date:

Client:

By:

Date:

What the Supplier Information Security Questionnaire Is

A Supplier Information Security Questionnaire is a standardized document used to assess a vendor's information security posture before onboarding or renewing a commercial relationship. It collects consistent, auditable answers about policies, controls, incident history, certifications, and technical safeguards so buyers can evaluate risk, map controls to contract obligations, and determine remediation or monitoring requirements. Responses typically feed into vendor risk management workflows, influence contracting decisions, and form the basis for follow-up evidence requests such as audit reports, penetration test results, or certificates of insurance.

Why a Supplier Information Security Questionnaire Matters

Using a formal questionnaire reduces onboarding risk by producing comparable, documented evidence of a supplier's security controls and compliance posture. It supports contractual negotiation, insurance review, and regulatory due diligence, creating a defensible record of what was asked and provided.

Who Completes and Reviews These Questionnaires

Procurement, information security, legal, and vendor management teams typically manage questionnaire issuance and review before contracts are signed.

Security and risk teams validate technical controls and evidence and score responses consistently.
Procurement and vendor management coordinate issuance, remediation tracking, and contractual requirements.
Legal reviews high-risk answers to shape contract clauses and indemnity language.

Suppliers should involve their security, privacy, and contracts contacts when completing responses to ensure accuracy and timely evidence submission.

Core Sections to Include in a Professional Questionnaire

A well-constructed Supplier Information Security Questionnaire groups items so reviewers can quickly find policy, technical, and evidence-related responses.

Scope

Define services, data types accessed, and geographic coverage so answers are targeted to the specific engagement and do not over- or under-represent risk.

Governance

Questions on policies, security ownership, training, background checks, and third-party oversight demonstrating organizational commitment to security and accountability.

Technical Controls

Items covering network segmentation, encryption in transit and at rest, MFA, patching cadence, logging, and privileged access management.

Incident Management

Expectations for breach notification timelines, forensic capability, tabletop exercises, and historical incident disclosures with remediation actions.

Compliance & Evidence

Request for certifications (SOC 2, ISO 27001), audit reports, penetration test summaries, and certificates of insurance where applicable.

Business Continuity

Questions on backup frequency, recovery time objectives, redundancy, and disaster recovery testing schedules.

Essential Information Fields to Collect

Company Legal Name: Full registered name

Primary Contact: Name, role, email

Service Description: Services provided

Data Types Accessed: PII, PHI, financial

Certifications: SOC 2, ISO 27001

Incident Contact: 24/7 phone or email

Step-by-Step: Completing the Questionnaire

Follow these stages to complete and return the questionnaire efficiently and with minimal follow-up.

01

Prepare: Gather policies, certificates, and evidence before starting.
02

Answer: Provide concise, factual responses; avoid vague terms.
03

Attach Evidence: Upload SOC reports, diagrams, and test summaries.
04

Confirm and Submit: Review for consistency, sign, and return by the due date.

Configuring an Online Questionnaire Workflow

Set up digital routing and validation so suppliers can complete questionnaires with clear authentication and automated evidence collection.

Field	Configuration
Authentication Method	Email + SMS OTP or SSO where available
Template Assignment	Associate questions to service or tier
Routing Order	Define review and approval steps
Response Validation	Required fields and file-type checks

Technical Requirements for eSubmission and Integration

Ensure your platform supports secure upload, audit trails, and integration with vendor management systems.

Integrations: Salesforce, NetSuite, or Box
File formats: PDF, DOCX, and CSV
Authentication: Email+SMS or SSO

Choose a solution that records signer identity, timestamps actions, and preserves immutable audit trails to support compliance and future disputes.

Where to Send Completed Questionnaires

Define a single submission channel and internal reviewers to avoid lost responses and inconsistent scoring.

Supplier Submission: Upload to secure portal or return via encrypted email
Initial Intake: Vendor management validates completeness
Security Review: Security team scores and requests evidence
Archival: Store final package in GRC or secure repository

Typical Timelines and Response Expectations

Set clear deadlines to keep onboarding on schedule and to allow time for evidence review and remediation.

Initial Response Window:

10–14 calendar days for questionnaire completion and initial evidence

Evidence Upload Deadline:

Concurrent with submission or within 5 business days of answers

Remediation Deadline:

30–90 days for high-risk findings, depending on contract

Periodic Reassessment:

Annual or upon material change in service

Follow-up Audit:

Triggered by critical answers or certification changes

Common Mistakes to Avoid When Preparing Responses

Providing vague answers such as 'we follow industry best practices' without specific policies or evidence.
Uploading outdated or redacted audit reports that do not match the answers given in the questionnaire.
Failing to identify subcontractors or subprocessors that have access to customer data.
Missing signature, printed name, title, or date on the final submission, causing administrative rejection.

Consequences of Inaccurate or Incomplete Responses

Contract Termination: Early termination rights or suspension

Financial Penalties: Liquidated damages or indemnity exposure

Data Breach Liability: Increased monetary and legal responsibility

Compliance Findings: Regulatory enforcement or remediation orders

Onboarding Delays: Delayed go-live and lost revenue opportunity

Reputational Harm: Trust erosion with customers

eSignature Vendor Comparison for Questionnaire Submission

Common vendor features and starting prices for electronic signature and workflow platforms used to issue and return Supplier Information Security Questionnaires.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Yes	Yes	Yes	Yes
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Real-World Examples of Questionnaire Use

These brief cases show how organizations use security questionnaires to reduce risk and speed onboarding.

Martin Properties

I can process and execute all of these documents online with 100% compliance and built-in security.

The platform works on mobile and offline.
The ability to collect standardized security answers and attach audit reports let Martin Properties close vendor integrations faster while maintaining compliance documentation for audits and lenders.

BIS

We felt most comfortable with airSlate SignNow given their SOC 2 certification and strict focus on ESIGN and UETA act compliance.

Security certifications mattered.
That assurance reduced our legal review time and allowed BIS to onboard critical suppliers with documented controls and retained evidence.

Practical Tips for Accurate and Efficient Completion

Apply these practices to speed review cycles and reduce follow-up requests.

Centralize Evidence

Consolidate SOC reports, policies, and network diagrams in a single secure location before starting the questionnaire so attachments match answers and reviewers avoid repeated evidence requests.

Use Scoped Templates

Create templates by service type and risk tier to avoid irrelevant questions and reduce supplier friction while ensuring necessary controls are evaluated.

Designate Respondents

Assign a named security contact for questionnaire completion to reduce internal reviews and to ensure responses are authoritative and consistent with audit evidence.

Maintain Version Control

Record questionnaire versions and dates so reviewers know which questionnaire and evidence set corresponds to the current contract or renewal period.

Frequently Asked Questions About Supplier Information Security Questionnaires

Answers to common questions about legal validity, evidence, signatures, and handling of sensitive data in questionnaire responses.

Need help? Contact support

Are electronic responses legally binding?
Yes. Electronic signatures and records are legally enforceable under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted, provided intent, consent, attribution, and retention criteria are met.
When is a BAA required?
A Business Associate Agreement is required when the supplier will create, receive, maintain, or transmit protected health information (PHI) under HIPAA; include it before exchanging PHI.
What evidence should accompany answers?
Attach redacted SOC 2 or ISO reports, penetration test summaries, network diagrams, and policy documents that correspond directly to questionnaire answers to avoid follow-up.
Who can sign the completed questionnaire?
An authorized officer or designated security contact should sign; contract terms may require sign-off by a corporate officer—verify signer authority with the buyer before submission.
Is remote notarization needed?
Not typically for security questionnaires. Use RON only if the buyer explicitly requires notarized attestations; verify state RON rules if used.
How long should answers and evidence be retained?
Retain for the duration of the contract plus an appropriate post-termination period; federal and industry rules may require specific minimums such as IRS or HIPAA retention periods.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now