# Vendor Security Questionnaire Template for Manufacturing Suppliers > Source: https://netray.co/tools/supplier-cybersecurity-assessment-questionnaire-template > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A ready-to-send vendor and supplier security questionnaire covering governance, access, data handling, incident reporting and OT-specific risks. ## Category compliance-legal ## Industry Discrete Manufacturing ## Audience - IT security lead - Supplier quality - Procurement ## Tool **Kind:** template **Output:** document **Fields:** #### Your company **Key:** company **Type:** text **Default:** Acme Precision Ltd #### Vendor or supplier name **Key:** vendor **Type:** text **Default:** Northline Machining Inc #### Vendor contact **Key:** contact **Type:** text **Default:** IT Manager #### Date sent **Key:** date **Type:** date **Default:** 2026-11-02 #### Response due **Key:** due **Type:** date **Default:** 2026-11-23 #### Service or relationship **Key:** scope **Type:** select **Options:** - Contract machining - Software or SaaS - Managed IT service - Equipment with remote support - Logistics or EDI partner **Default:** Contract machining #### Data the vendor will handle **Key:** data **Type:** textarea **Default:** Customer drawings and specifications, purchase orders, inspection reports. #### Internal owner **Key:** owner **Type:** text **Default:** Supplier Quality Manager **Blocks:** #### Supplier Cybersecurity Questionnaire **Body:** From: {{company}} To: {{vendor}} (attention: {{contact}}) Relationship: {{scope}} Date sent: {{date}} Response due: {{due}} Internal owner: {{owner}} Please answer each question Yes, No, Partial or N/A and add comments or evidence references. Answers are used to decide what access and data we can share. Information is treated as confidential. #### Scope of data and access **Body:** Data to be handled by {{vendor}}: {{data}} #### A. Governance **Table:** **Columns:** - # - Question - Answer - Comments or evidence **Rows:** **0:** A1 **1:** Is there a named person responsible for information security? **0:** A2 **1:** Do you maintain written security policies reviewed at least yearly? **0:** A3 **1:** Do you hold a security certification or attestation (for example ISO 27001, SOC 2, CMMC level, or TISAX)? List scope and date. **0:** A4 **1:** Do employees receive security awareness training at hire and yearly? #### B. Access and identity **Table:** **Columns:** - # - Question - Answer - Comments or evidence **Rows:** **0:** B1 **1:** Is multi-factor authentication required for email, remote access and administrator accounts? **0:** B2 **1:** Are user accounts individual, and reviewed when staff leave or change roles? **0:** B3 **1:** Is access to our data limited to people who need it? **0:** B4 **1:** Do subcontractors or other third parties have access to our data? If yes, list them. #### C. Systems and data protection **Table:** **Columns:** - # - Question - Answer - Comments or evidence **Rows:** **0:** C1 **1:** Is endpoint protection deployed and centrally managed on all systems that handle our data? **0:** C2 **1:** How quickly are critical security patches applied to internet-facing systems? **0:** C3 **1:** Is our data encrypted in transit, and at rest on laptops and servers? **0:** C4 **1:** Are backups kept offline or immutable, and restore-tested at least yearly? **0:** C5 **1:** Where is our data stored and processed (countries)? #### D. Incident management **Table:** **Columns:** - # - Question - Answer - Comments or evidence **Rows:** **0:** D1 **1:** Do you have a documented incident response plan that was tested in the last 12 months? **0:** D2 **1:** Will you notify us of an incident affecting our data? Within what time? **0:** D3 **1:** Have you had a security incident in the last 3 years that affected customer data or operations? Summarize. **0:** D4 **1:** Do you carry cyber insurance? State the limit. #### E. Plant floor and connected equipment (if applicable) **Table:** **Columns:** - # - Question - Answer - Comments or evidence **Rows:** **0:** E1 **1:** Are production networks separated from office networks? **0:** E2 **1:** Is remote support to equipment performed through approved, logged sessions with MFA? **0:** E3 **1:** Are CNC, PLC and controller programs backed up and access-controlled? **0:** E4 **1:** Are removable media and engineering laptops scanned and controlled before connecting? #### F. Regulatory and contractual flow-down **Table:** **Columns:** - # - Question - Answer - Comments or evidence **Rows:** **0:** F1 **1:** Do you handle export-controlled or controlled unclassified information (CUI) for any customer? Describe safeguards. **0:** F2 **1:** Can you meet security clauses we flow down to suppliers, such as incident reporting and audit rights? #### Declaration **Signatures:** - Vendor representative (name, title, date) - Reviewed by (internal owner) **Notes:** A starting point, not legal advice. Trim it to the risk of the relationship: a coffee supplier does not need section E, a contract machinist handling controlled drawings does. Score answers with a simple rule such as Yes = 2, Partial = 1, No = 0 and require evidence for critical items. ## Content **Intro:** A good vendor security questionnaire is short enough to be answered honestly and specific enough to find real gaps. This template covers governance, access, data protection, incident handling and the plant-floor questions most generic forms skip. **Sections:** #### How to use the questionnaire **Body:** Pick the vendor, relationship and data in the fields, then export. Send it with a due date and a named internal owner. Match depth to risk: use all sections for vendors that hold your drawings, connect to your network or support your machines remotely, and cut sections E and F for low-risk suppliers. When answers arrive, ask for evidence on anything that matters, such as the date of the last restore test or the scope of an ISO 27001 certificate. **Bullets:** - Tier suppliers by data sensitivity and access first - Ask for evidence on critical answers - Re-send yearly or on contract renewal #### What each section tests **Body:** Governance shows whether security has an owner. Access and identity checks the controls attackers abuse most: weak accounts and missing multi-factor authentication. Systems and data protection covers patching, encryption and backups. Incident management shows whether you would hear about a breach in time. Section E covers connected equipment and remote support, where a supplier's laptop can become your way in. Section F is for flow-down obligations in defense and regulated supply chains. #### Common mistakes **Body:** Sending a 300-question form to every supplier produces copied answers and no insight. Accepting a certificate without checking scope is another mistake: a certificate for a head office says little about the shop that machines your parts. Finally, a questionnaire without follow-up is paperwork. Record gaps, agree remediation dates, and escalate when critical items stay open. **Bullets:** - Match the form to the risk - Read certificate scope and date - Track remediation to closure **Cta:** If you run hundreds of suppliers and want questionnaire responses summarized and compared automatically using private AI, Netray can scope that with you. The template is free as it stands. **Faq:** #### How long should a supplier security questionnaire be? **Answer:** For most manufacturing suppliers, 20 to 40 well-chosen questions is enough. Longer forms get copy-pasted answers. Use the tiers: a short form for low-risk vendors and the full form for those with data or network access. #### Can I accept a certificate instead of the questionnaire? **Answer:** Sometimes, if the scope covers the relevant site and service and the date is current. Even then, ask the plant-floor and incident-notification questions, because certificates often do not address your specific contractual needs. #### What about suppliers handling CUI or export-controlled data? **Answer:** Section F asks the basic flow-down questions. Actual obligations depend on your contracts, for example DFARS and CMMC clauses, and should be reviewed with your compliance team or counsel. #### How do I score the answers? **Answer:** A simple approach is Yes = 2, Partial = 1, No = 0 with required evidence for critical items such as MFA and tested backups. Set a minimum score per tier and agree remediation dates with suppliers that fall short. ## Search terms vendor security questionnaire template, supplier cybersecurity questionnaire, third party risk assessment questionnaire template, vendor risk assessment form manufacturing, supplier security assessment template word, supply chain cybersecurity questionnaire, vendor due diligence security --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json