> Acme Inc — Vendor Evaluation Questionnaire

>

> Effective Date: 2026-03-19

>

> Generated by Codepliant Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

## 1. Purpose

This questionnaire is used by Acme Inc to evaluate the security, privacy, and compliance posture of prospective vendors and sub-processors before onboarding. All vendors that will process personal data on behalf of Acme Inc must complete this assessment.

When to use this template:

- Evaluating a new SaaS vendor or sub-processor
- Renewing an existing vendor relationship (annually)
- Vendor undergoes a material change (acquisition, breach, new data processing)
- Adding a new integration that processes personal data

## 2. Vendor Information

Field | Response
--- | ---
Vendor name |
Vendor website |
Primary contact name |
Primary contact email |
Service description |
Data processing location(s) |
Contract start date |
Assessment completed by |
Assessment date |

## 3. Data Classification

Identify what data the vendor will access or process:

Data Category | Yes/No | Details
--- | --- | ---
Personal identifiers (name, email, phone) |  |
Financial data (payment, billing) |  |
Authentication credentials |  |
Health data |  |
Biometric data |  |
Location data |  |
Behavioural / usage analytics |  |
Children's data (under 16) |  |
AI training data |  |
AI model outputs / inferences |  |
Employee data |  |
Other (describe) |  |

## 4. Security Assessment

### 4.1 Infrastructure & Architecture

# | Question | Response | Score (0-3)
--- | --- | --- | ---
S1 | Do you encrypt data at rest? (Specify algorithm) |  |
S2 | Do you encrypt data in transit? (TLS 1.2+ minimum) |  |
S3 | Do you support customer-managed encryption keys (CMEK)? |  |
S4 | Where is data stored? List all regions/data centres. |  |
S5 | Do you maintain network segmentation between tenants? |  |
S6 | Do you use a Web Application Firewall (WAF)? |  |
S7 | Do you have DDoS protection in place? |  |

### 4.2 Access Control

# | Question | Response | Score (0-3)
--- | --- | --- | ---
S8 | Do you enforce multi-factor authentication (MFA) for all staff? |  |
S9 | Do you implement role-based access control (RBAC)? |  |
S10 | How are privileged access accounts managed? |  |
S11 | Do you perform periodic access reviews? (Frequency?) |  |
S12 | Do you have an automated offboarding process for revoked access? |  |

### 4.3 Incident Response

# | Question | Response | Score (0-3)
--- | --- | --- | ---
S13 | Do you have a documented incident response plan? |  |
S14 | What is your breach notification timeline? (Hours) |  |
S15 | Have you had a data breach in the last 24 months? |  |
S16 | Do you conduct incident response drills? (Frequency?) |  |
S17 | Do you have cyber insurance? |  |

### 4.4 Vulnerability Management

# | Question | Response | Score (0-3)
--- | --- | --- | ---
S18 | Do you perform regular penetration testing? (Frequency?) |  |
S19 | Do you have a vulnerability disclosure programme? |  |
S20 | What is your patch management SLA for critical vulnerabilities? |  |
S21 | Do you perform static/dynamic application security testing (SAST/DAST)? |  |

## 5. Privacy Assessment

# | Question | Response | Score (0-3)
--- | --- | --- | ---
P1 | Do you have a published privacy policy? (Provide URL) |  |
P2 | Do you process data only as instructed by the controller? |  |
P3 | Can you support data subject access requests (DSARs)? |  |
P4 | Can you support data deletion requests? (Timeline?) |  |
P5 | Can you export data in a portable format? (Which formats?) |  |
P6 | Do you use sub-processors? (List them) |  |
P7 | Do you notify customers before adding/changing sub-processors? |  |
P8 | Do you conduct Data Protection Impact Assessments (DPIAs)? |  |
P9 | Do you have a Data Protection Officer (DPO)? (Contact details) |  |
P10 | What is your data retention policy? |  |
P11 | Do you anonymise or pseudonymise personal data? |  |
P12 | Do you use customer data for AI model training? (Opt-out available?) |  |
P13 | Do you provide transparency reports for automated decision-making? |  |

## 6. Compliance Assessment

### 6.1 Certifications & Attestations

# | Question | Response | Score (0-3)
--- | --- | --- | ---
C1 | Do you hold SOC 2 Type II certification? (Date of last report) |  |
C2 | Do you hold ISO 27001 certification? (Certificate number) |  |
C3 | Are you GDPR compliant? (Provide evidence) |  |
C5 | Do you hold PCI DSS certification? (Level?) |  |
C6 | Do you have a HIPAA BAA available (if applicable)? |  |
C7 | Are audit reports available to customers upon request? |  |

### 6.2 Contractual

# | Question | Response | Score (0-3)
--- | --- | --- | ---
C8 | Can you sign a Data Processing Agreement (DPA)? |  |
C9 | Can you agree to Standard Contractual Clauses (SCCs) for international transfers? |  |
C10 | Do you offer data processing addendums for specific jurisdictions? |  |
C11 | What is your liability cap for data breaches? |  |
C12 | Do you have a business continuity / disaster recovery plan? |  |
C13 | What are your SLA commitments? (Uptime, support response time) |  |

## 7. Scoring Rubric

### 7.1 Score Definitions

Score | Meaning | Description
--- | --- | ---
0 | Not implemented | No capability or evidence exists
1 | Partial | Some measures exist but are incomplete or informal
2 | Implemented | Measures are in place and documented
3 | Mature | Measures are in place, documented, audited, and continuously improved

### 7.2 Scoring Thresholds

Category | Questions | Max Score
--- | --- | ---
Security (S1-S21) | 21 | 63
Privacy (P1-P13) | 13 | 39
Compliance (C1-C15) | 15 | 45
Total | 51 | 153

### 7.3 Risk Classification

Overall Score (%) | Risk Level | Decision
--- | --- | ---
≥ 85% | Low Risk | Approved — standard DPA required
70-84% | Medium Risk | Conditional approval — remediation plan required within 90 days
50-69% | High Risk | Escalate to Privacy Steering Committee — additional controls required
< 50% | Critical Risk | Do not proceed — vendor does not meet minimum requirements

### 7.4 Mandatory Requirements (Hard Fails)

The following are non-negotiable. A score of 0 on any of these results in automatic rejection:

- S1 — Data must be encrypted at rest
- S2 — Data must be encrypted in transit (TLS 1.2+)
- S13 — Must have a documented incident response plan
- S14 — Breach notification within 72 hours
- P2 — Must process data only as instructed
- C8 — Must sign a DPA

## 8. Assessment Workflow

    1. Business owner submits vendor request
         ↓
    2. DPO sends this questionnaire to vendor
         ↓
    3. Vendor completes and returns with evidence
         ↓
    4. DPO scores responses and classifies risk
         ↓
    5a. Low/Medium Risk → DPO approves (with conditions if medium)
    5b. High Risk → Privacy Steering Committee review
    5c. Critical Risk → Rejected
         ↓
    6. DPA executed, vendor added to sub-processor list
         ↓
    7. Annual reassessment scheduled

## 9. Assessment Summary

To be completed by the assessor:

Field | Value
--- | ---
Vendor name |
Total score | /
Percentage | %
Risk level | Low / Medium / High / Critical
Hard fail triggers | None / List items
Decision | Approved / Conditional / Escalated / Rejected
Conditions (if any) |
Assessed by |
Assessment date |
Next review date |

## 10. Contact

For questions about vendor due diligence:

- DPO: dpo@acme-saas.com
- General Contact: legal@acme.com

This Third-Party Due Diligence Template was auto-generated by Codepliant based on code analysis. Customise the questions and scoring thresholds to match your risk appetite. Review with your DPO and legal counsel before use.