# Third-Party Due Diligence Template

> **Acme Inc** — Vendor Evaluation Questionnaire
>
> **Effective Date:** 2026-03-19
>
> Generated by [Codepliant](https://github.com/joechensmartz/codepliant)
> **Document Version:** 1.0  
> **Document Owner:** Acme Inc  
> **Next Review Date:** 2027-03-19

---

## 1. Purpose

This questionnaire is used by Acme Inc to evaluate the security, privacy, and compliance posture of prospective vendors and sub-processors before onboarding. All vendors that will process personal data on behalf of Acme Inc must complete this assessment.

**When to use this template:**

- Evaluating a new SaaS vendor or sub-processor
- Renewing an existing vendor relationship (annually)
- Vendor undergoes a material change (acquisition, breach, new data processing)
- Adding a new integration that processes personal data

## 2. Vendor Information

| Field | Response |
|-------|----------|
| **Vendor name** | |
| **Vendor website** | |
| **Primary contact name** | |
| **Primary contact email** | |
| **Service description** | |
| **Data processing location(s)** | |
| **Contract start date** | |
| **Assessment completed by** | |
| **Assessment date** | |

## 3. Data Classification

Identify what data the vendor will access or process:

| Data Category | Yes/No | Details |
|--------------|--------|---------|
| Personal identifiers (name, email, phone) | | |
| Financial data (payment, billing) | | |
| Authentication credentials | | |
| Health data | | |
| Biometric data | | |
| Location data | | |
| Behavioural / usage analytics | | |
| Children's data (under 16) | | |
| AI training data | | |
| AI model outputs / inferences | | |
| Employee data | | |
| Other (describe) | | |

## 4. Security Assessment

### 4.1 Infrastructure & Architecture

| # | Question | Response | Score (0-3) |
|---|----------|----------|-------------|
| S1 | Do you encrypt data at rest? (Specify algorithm) | | |
| S2 | Do you encrypt data in transit? (TLS 1.2+ minimum) | | |
| S3 | Do you support customer-managed encryption keys (CMEK)? | | |
| S4 | Where is data stored? List all regions/data centres. | | |
| S5 | Do you maintain network segmentation between tenants? | | |
| S6 | Do you use a Web Application Firewall (WAF)? | | |
| S7 | Do you have DDoS protection in place? | | |

### 4.2 Access Control

| # | Question | Response | Score (0-3) |
|---|----------|----------|-------------|
| S8 | Do you enforce multi-factor authentication (MFA) for all staff? | | |
| S9 | Do you implement role-based access control (RBAC)? | | |
| S10 | How are privileged access accounts managed? | | |
| S11 | Do you perform periodic access reviews? (Frequency?) | | |
| S12 | Do you have an automated offboarding process for revoked access? | | |

### 4.3 Incident Response

| # | Question | Response | Score (0-3) |
|---|----------|----------|-------------|
| S13 | Do you have a documented incident response plan? | | |
| S14 | What is your breach notification timeline? (Hours) | | |
| S15 | Have you had a data breach in the last 24 months? | | |
| S16 | Do you conduct incident response drills? (Frequency?) | | |
| S17 | Do you have cyber insurance? | | |

### 4.4 Vulnerability Management

| # | Question | Response | Score (0-3) |
|---|----------|----------|-------------|
| S18 | Do you perform regular penetration testing? (Frequency?) | | |
| S19 | Do you have a vulnerability disclosure programme? | | |
| S20 | What is your patch management SLA for critical vulnerabilities? | | |
| S21 | Do you perform static/dynamic application security testing (SAST/DAST)? | | |

## 5. Privacy Assessment

| # | Question | Response | Score (0-3) |
|---|----------|----------|-------------|
| P1 | Do you have a published privacy policy? (Provide URL) | | |
| P2 | Do you process data only as instructed by the controller? | | |
| P3 | Can you support data subject access requests (DSARs)? | | |
| P4 | Can you support data deletion requests? (Timeline?) | | |
| P5 | Can you export data in a portable format? (Which formats?) | | |
| P6 | Do you use sub-processors? (List them) | | |
| P7 | Do you notify customers before adding/changing sub-processors? | | |
| P8 | Do you conduct Data Protection Impact Assessments (DPIAs)? | | |
| P9 | Do you have a Data Protection Officer (DPO)? (Contact details) | | |
| P10 | What is your data retention policy? | | |
| P11 | Do you anonymise or pseudonymise personal data? | | |
| P12 | Do you use customer data for AI model training? (Opt-out available?) | | |
| P13 | Do you provide transparency reports for automated decision-making? | | |

## 6. Compliance Assessment

### 6.1 Certifications & Attestations

| # | Question | Response | Score (0-3) |
|---|----------|----------|-------------|
| C1 | Do you hold SOC 2 Type II certification? (Date of last report) | | |
| C2 | Do you hold ISO 27001 certification? (Certificate number) | | |
| C3 | Are you GDPR compliant? (Provide evidence) | | |
| C5 | Do you hold PCI DSS certification? (Level?) | | |
| C6 | Do you have a HIPAA BAA available (if applicable)? | | |
| C7 | Are audit reports available to customers upon request? | | |

### 6.2 Contractual

| # | Question | Response | Score (0-3) |
|---|----------|----------|-------------|
| C8 | Can you sign a Data Processing Agreement (DPA)? | | |
| C9 | Can you agree to Standard Contractual Clauses (SCCs) for international transfers? | | |
| C10 | Do you offer data processing addendums for specific jurisdictions? | | |
| C11 | What is your liability cap for data breaches? | | |
| C12 | Do you have a business continuity / disaster recovery plan? | | |
| C13 | What are your SLA commitments? (Uptime, support response time) | | |

## 7. Scoring Rubric

### 7.1 Score Definitions

| Score | Meaning | Description |
|-------|---------|-------------|
| **0** | Not implemented | No capability or evidence exists |
| **1** | Partial | Some measures exist but are incomplete or informal |
| **2** | Implemented | Measures are in place and documented |
| **3** | Mature | Measures are in place, documented, audited, and continuously improved |

### 7.2 Scoring Thresholds

| Category | Questions | Max Score |
|----------|-----------|-----------|
| Security (S1-S21) | 21 | 63 |
| Privacy (P1-P13) | 13 | 39 |
| Compliance (C1-C15) | 15 | 45 |
| **Total** | **51** | **153** |

### 7.3 Risk Classification

| Overall Score (%) | Risk Level | Decision |
|-------------------|------------|----------|
| ≥ 85% | **Low Risk** | Approved — standard DPA required |
| 70-84% | **Medium Risk** | Conditional approval — remediation plan required within 90 days |
| 50-69% | **High Risk** | Escalate to Privacy Steering Committee — additional controls required |
| < 50% | **Critical Risk** | **Do not proceed** — vendor does not meet minimum requirements |

### 7.4 Mandatory Requirements (Hard Fails)

The following are non-negotiable. A score of 0 on any of these results in automatic rejection:

- **S1** — Data must be encrypted at rest
- **S2** — Data must be encrypted in transit (TLS 1.2+)
- **S13** — Must have a documented incident response plan
- **S14** — Breach notification within 72 hours
- **P2** — Must process data only as instructed
- **C8** — Must sign a DPA

## 8. Assessment Workflow

```
1. Business owner submits vendor request
     ↓
2. DPO sends this questionnaire to vendor
     ↓
3. Vendor completes and returns with evidence
     ↓
4. DPO scores responses and classifies risk
     ↓
5a. Low/Medium Risk → DPO approves (with conditions if medium)
5b. High Risk → Privacy Steering Committee review
5c. Critical Risk → Rejected
     ↓
6. DPA executed, vendor added to sub-processor list
     ↓
7. Annual reassessment scheduled
```

## 9. Assessment Summary

*To be completed by the assessor:*

| Field | Value |
|-------|-------|
| **Vendor name** | |
| **Total score** | /  |
| **Percentage** | % |
| **Risk level** | Low / Medium / High / Critical |
| **Hard fail triggers** | None / List items |
| **Decision** | Approved / Conditional / Escalated / Rejected |
| **Conditions (if any)** | |
| **Assessed by** | |
| **Assessment date** | |
| **Next review date** | |

## 10. Contact

For questions about vendor due diligence:

- **DPO:** dpo@acme-saas.com
- **General Contact:** legal@acme.com

---

*This Third-Party Due Diligence Template was auto-generated by [Codepliant](https://github.com/joechensmartz/codepliant) based on code analysis. Customise the questions and scoring thresholds to match your risk appetite. Review with your DPO and legal counsel before use.*
