A vendor security questionnaire for small organizations

Send one before you sign with any vendor that will hold or access your sensitive data or your systems: IT and managed service providers, payroll and HR platforms, practice and client management software, cloud file services, marketing platforms with client lists, and anyone with remote access. Under PIPEDA, an organization remains responsible for personal information it transfers to a third party for processing, and the Office of the Privacy Commissioner's guidelines on processing personal data across borders say contractual or other means must provide a comparable level of protection while the information is with the third party.

Repeat it at renewal, or when the vendor is acquired or changes how it delivers the service.

Long questionnaires get long, unhelpful answers. These questions, drawn from common control areas in ISO/IEC 27001:2022 Annex A and the Canadian Centre for Cyber Security's supply chain guidance, separate strong vendors from weak ones.

1. 01

   Access

   1. Is multi-factor authentication enforced for all staff and admin access to systems holding our data? 2. How is access removed when your staff leave? 3. Do you review who has access to customer data, and how often?

2. 02

   Protection

   4. Is our data encrypted in transit and at rest? 5. How are your laptops and servers patched and protected? 6. Do you separate our data from other customers' data?

3. 03

   Resilience

   7. How often is our data backed up, and is at least one copy immutable or offline? 8. When did you last test a restore? 9. What is your recovery plan if your platform is unavailable?

4. 04

   Detection and response

   10. Do you monitor for suspicious activity, and who reviews alerts? 11. Do you have a written incident response plan, tested in the last year? 12. Have you had a security incident affecting customer data in the past three years?

5. 05

   Assurance

   13. What independent assessments do you have (for example SOC 2 or ISO 27001 certification), and can we see the report or certificate? 14. Do you carry cyber insurance?

6. 06

   People

   15. Do staff receive security awareness training? 16. Are background checks done for staff with access to customer data?

17. Where will our data be stored and processed, including backups and support access? 18. Which subprocessors handle our data, and will you notify us before adding new ones?

Data stored outside Canada is not prohibited for most private-sector organizations, but the OPC expects organizations to be transparent with individuals that their information may be processed in another jurisdiction and accessible to that jurisdiction's authorities. Quebec has additional requirements for transfers outside the province. Knowing the answer lets you meet your own obligations.

19. How quickly will you notify us of a security incident involving our data, and what information will you provide? 20. Will you cooperate with our investigation, including providing logs?

Your own legal deadlines start when you know about a breach. A vendor that commits only to notify 'without undue delay', or not at all, can leave you unable to meet them. Look for a specific notice period in hours or days, a named contact, and a commitment to share the facts you need to assess risk.

Answers matter only if they end up in the contract. Carry the important ones into the agreement or a data processing addendum: security obligations, breach notice period, subprocessors, data location, return and deletion at the end, audit or evidence rights, and insurance. Keep the completed questionnaire on file with the contract, and diarize the renewal review.

We review vendor responses for clients and help negotiate the security terms that matter.