Third-Party Risk Assessment Questionnaire

Third-Party Risk Assessment Questionnaire — Form Fields

This operations template includes 12 fields. Collect security, compliance, and operational risk information from third-party vendors before contract award. Free to customize and use on ZenBuild.

• Vendor Company Name (text, required)
• Vendor Contact Name (text, required)
• Vendor Contact Email (email, required)
• Service Type (dropdown selection, required) — options: SaaS software, Professional services, Cloud infrastructure, Hardware, Data processing, Other
• Will vendor access our data? (dropdown selection, required) — options: Yes - customer data, Yes - internal data only, No
• Does vendor process PII or sensitive data? (dropdown selection, required) — options: Yes, No, Uncertain
• Is vendor SOC 2 Type II certified? (dropdown selection, required) — options: Yes, No, In progress, Not applicable
• Does vendor have a written information security policy? (dropdown selection, required) — options: Yes, No, Unknown
• Last penetration test performed (dropdown selection, required) — options: Within 12 months, 1-2 years ago, More than 2 years ago, Never, Unknown
• List of subprocessors or fourth parties (long text, optional)
• Does vendor have a documented incident response plan? (dropdown selection, required) — options: Yes, No, Unknown
• Additional risk notes (long text, optional)