SaaS Vendor Security Questionnaire — the 35 questions enterprise buyers actually ask

1. 1.1
   Do you have a formal information security program with executive ownership? Provide the policy effective date and review cadence.
   Critical
2. 1.2
   List all current security certifications and attestations (SOC 2 Type II, ISO 27001, HIPAA, PCI DSS, FedRAMP, etc.) with audit firm and most recent report date.
   Critical
3. 1.3
   Do you carry cyber liability insurance? Provide limits and a redacted COI on request.
   High
4. 1.4
   How often is your security policy set reviewed and updated? Who approves changes?
   High
5. 1.5
   Do you perform an annual enterprise risk assessment? Describe the methodology (e.g. NIST RMF, ISO 31000).
   Medium

1. 2.1
   Is SSO via SAML 2.0 or OIDC available on the customer-facing tier the buyer would purchase? Any upcharge?
   Critical
2. 2.2
   Is MFA enforced for all employees with access to production systems and customer data? List the factor types accepted.
   Critical
3. 2.3
   How is privileged access granted, reviewed, and revoked? Provide the access-review cadence.
   Critical
4. 2.4
   Describe your offboarding process. Maximum time between termination and full access revocation?
   High
5. 2.5
   Are service accounts inventoried and rotated? What is the rotation cadence?
   Medium

1. 3.1
   How is customer data encrypted at rest? Specify algorithm, key length, and key management provider (AWS KMS, GCP KMS, HSM, etc.).
   Critical
2. 3.2
   How is data encrypted in transit? Minimum TLS version and cipher suites enforced?
   Critical
3. 3.3
   Do you support customer-managed encryption keys (CMEK / BYOK)? On what plan tier?
   High
4. 3.4
   Describe your data classification scheme and how it maps to handling controls.
   High
5. 3.5
   Upon contract termination, what is the deletion SLA for customer data (production + backups)?
   Critical

1. 4.1
   What cloud provider(s) and region(s) host customer data? Can data residency be pinned to a region?
   Critical
2. 4.2
   Describe your network segmentation between customer environments. Single-tenant or multi-tenant?
   High
3. 4.3
   What is your patch cadence for critical OS and library CVEs? Maximum window from CVSS 9+ disclosure to deployment?
   Critical
4. 4.4
   How often is external pen testing conducted, by whom, and is an executive summary available under NDA?
   High
5. 4.5
   Do you use a WAF, DDoS protection, and IDS/IPS? Name the provider(s).
   Medium

1. 5.1
   Is peer code review mandatory before merge to main? How is the policy enforced (branch protection, approvals)?
   High
2. 5.2
   What SAST, DAST, and SCA tools are in your CI pipeline? Are critical findings blocking?
   High
3. 5.3
   Do developers have access to production data? If yes, how is that controlled and audited?
   Critical
4. 5.4
   Do you maintain a software bill of materials (SBOM) per release?
   Medium

1. 6.1
   Provide your customer breach-notification SLA in writing (max hours from confirmed incident to first customer notice).
   Critical
2. 6.2
   Is your incident response plan tested at least annually? Describe the last tabletop exercise scenario and outcomes.
   High
3. 6.3
   What are your RTO and RPO for the production service? When were they last validated by a DR test?
   Critical
4. 6.4
   Where are backups stored and are they encrypted? Are they tested for restorability?
   High

1. 7.1
   Maintain and publish a current list of subprocessors (name, function, country, data accessed). Provide URL.
   Critical
2. 7.2
   Do you perform security due diligence on subprocessors before onboarding? Describe the gating criteria.
   High
3. 7.3
   What advance notice do customers receive before a new subprocessor is added or replaced?
   High
4. 7.4
   Are DPAs or equivalent contractual data-protection terms in place with every subprocessor handling personal data?
   Critical

Run a free SOC 2 / SIG Lite audit. ComplianceIQ uses your audit responses and generated policies to populate an answer pack you can paste into any SIG, CAIQ, or custom enterprise questionnaire — in minutes, not days.