IT and SaaS supplier security and compliance questionnaire
For software, cloud and IT service suppliers: security certification, data protection, technical controls, resilience, service levels, AI use and exit.
- Free Excel file, no sign-up
- 22 questions, 7 sections
- Critical questions flag gaps
- Scores and rating calculated
| A | B | C | D | E | |
|---|---|---|---|---|---|
| 4 | No. | Question | Answer | Criticality | Points |
| 5 | 1.1 | ISO/IEC 27001 or SOC 2 Type II covering the service? | Yes | Critical | 2 |
| 6 | 2.2 | Sub-processors listed with notice of changes? | Yes | Critical | 2 |
| 7 | 4.1 | Tested continuity plan with stated RTO and RPO? | Partly | Critical | 1 |
| 8 | 6.1 | Customer data used to train AI, with opt-out? | No | Critical | 0 |
What is inside
3 sheets, ready to use.
Yellow cells are yours to fill in. Grey cells calculate. Every sheet has a worked example so you can see the expected format.
Read me
Purpose, scoring rules, colour legend and assumptions.
Questionnaire
7 sections with Critical and Standard questions, answer dropdowns and an evidence column.
Summary
Score per section, overall score, critical gaps and a rating with editable thresholds.
How to use it
Four steps from download to a decision.
No macros, no add-ins. It works in Excel, Google Sheets and LibreOffice.
01
Send the Questionnaire sheet to the supplier. They answer each question Yes, Partly, No or N.A. and add evidence.
02
Yes scores 2, Partly 1 and No 0. N.A. is left out, so suppliers are not penalised for questions that do not apply.
03
The Summary sheet shows a score per section and overall. The rating stays In progress until every question is answered.
04
Any No on a Critical question makes the rating conditional. Follow those up first, whatever the total.
Spreadsheet or platform
Start in Excel. Move when the volume or the stakes grow.
The template and the platform use the same structure, so nothing you set up here is wasted.
This spreadsheet is enough when
- You assess a handful of new suppliers a year
- One person sends, collects and scores the answers
- You do not need to compare suppliers or track change over time
Move it into EvaluationsHub when you need to
- Send the same questionnaire to dozens of suppliers and chase answers automatically
- Score answers as they arrive and flag critical gaps for follow-up
- Keep evidence, certificates and expiry dates on one supplier record
- Compare suppliers and re-run the assessment every year without rebuilding it
Questions
Before you download
Does this replace a security questionnaire such as SIG or CAIQ?
It is a lighter first screen. For vendors that handle sensitive data, ask for certificates such as ISO 27001 or SOC 2 and, where needed, a full standard questionnaire. SIG, CAIQ and ISO 27001 questionnaires compared →
Is the template really free?
Yes. The file downloads directly, with no form and no email address.
When should we move this out of Excel?
When several people rate the same suppliers, when suppliers need to see their results, or when actions get lost between file versions. That is usually the point where a shared platform pays back. Signs you have outgrown the spreadsheet →
Related templates
Next steps in the supplier lifecycle.
Templates that pick up where this one ends.
Supplier onboarding checklist
21 onboarding tasks in five phases with owners, due dates and progress.
View template →
Supplier risk register with heat map
Likelihood and impact before and after mitigation, review dates and a heat map.
View template →
ESG and sustainability supplier questionnaire
19 ESG questions across governance, climate, human rights and ethics.
View template →
Run it live
Run this process with your suppliers, not just in a file.
Start a free sandbox and set it up yourself: send requests and surveys to real suppliers, collect answers and see scores in one place.
