Vendor Security Questionnaire Template for Manufacturing Suppliers
A good vendor security questionnaire is short enough to be answered honestly and specific enough to find real gaps. This template covers governance, access, data protection, incident handling and the plant-floor questions most generic forms skip.
Fill in
Supplier Cybersecurity Assessment Questionnaire Template
Supplier Cybersecurity Questionnaire
From: Acme Precision Ltd To: Northline Machining Inc (attention: IT Manager) Relationship: Contract machining Date sent: 2026-11-02 Response due: 2026-11-23 Internal owner: Supplier Quality Manager
Please answer each question Yes, No, Partial or N/A and add comments or evidence references. Answers are used to decide what access and data we can share. Information is treated as confidential.
Scope of data and access
Data to be handled by Northline Machining Inc: Customer drawings and specifications, purchase orders, inspection reports.
A. Governance
| # | Question | Answer | Comments or evidence |
|---|---|---|---|
| A1 | Is there a named person responsible for information security? | ||
| A2 | Do you maintain written security policies reviewed at least yearly? | ||
| A3 | Do you hold a security certification or attestation (for example ISO 27001, SOC 2, CMMC level, or TISAX)? List scope and date. | ||
| A4 | Do employees receive security awareness training at hire and yearly? |
B. Access and identity
| # | Question | Answer | Comments or evidence |
|---|---|---|---|
| B1 | Is multi-factor authentication required for email, remote access and administrator accounts? | ||
| B2 | Are user accounts individual, and reviewed when staff leave or change roles? | ||
| B3 | Is access to our data limited to people who need it? | ||
| B4 | Do subcontractors or other third parties have access to our data? If yes, list them. |
C. Systems and data protection
| # | Question | Answer | Comments or evidence |
|---|---|---|---|
| C1 | Is endpoint protection deployed and centrally managed on all systems that handle our data? | ||
| C2 | How quickly are critical security patches applied to internet-facing systems? | ||
| C3 | Is our data encrypted in transit, and at rest on laptops and servers? | ||
| C4 | Are backups kept offline or immutable, and restore-tested at least yearly? | ||
| C5 | Where is our data stored and processed (countries)? |
D. Incident management
| # | Question | Answer | Comments or evidence |
|---|---|---|---|
| D1 | Do you have a documented incident response plan that was tested in the last 12 months? | ||
| D2 | Will you notify us of an incident affecting our data? Within what time? | ||
| D3 | Have you had a security incident in the last 3 years that affected customer data or operations? Summarize. | ||
| D4 | Do you carry cyber insurance? State the limit. |
E. Plant floor and connected equipment (if applicable)
| # | Question | Answer | Comments or evidence |
|---|---|---|---|
| E1 | Are production networks separated from office networks? | ||
| E2 | Is remote support to equipment performed through approved, logged sessions with MFA? | ||
| E3 | Are CNC, PLC and controller programs backed up and access-controlled? | ||
| E4 | Are removable media and engineering laptops scanned and controlled before connecting? |
F. Regulatory and contractual flow-down
| # | Question | Answer | Comments or evidence |
|---|---|---|---|
| F1 | Do you handle export-controlled or controlled unclassified information (CUI) for any customer? Describe safeguards. | ||
| F2 | Can you meet security clauses we flow down to suppliers, such as incident reporting and audit rights? |
Declaration
A starting point, not legal advice. Trim it to the risk of the relationship: a coffee supplier does not need section E, a contract machinist handling controlled drawings does. Score answers with a simple rule such as Yes = 2, Partial = 1, No = 0 and require evidence for critical items.
Optional supplier response analysis
Want questionnaire answers compared and summarized automatically on your own servers? We can discuss a private AI approach.
Optional. The tool and every export work without this. No spam.
How to use the questionnaire
Pick the vendor, relationship and data in the fields, then export. Send it with a due date and a named internal owner. Match depth to risk: use all sections for vendors that hold your drawings, connect to your network or support your machines remotely, and cut sections E and F for low-risk suppliers. When answers arrive, ask for evidence on anything that matters, such as the date of the last restore test or the scope of an ISO 27001 certificate.
- Tier suppliers by data sensitivity and access first
- Ask for evidence on critical answers
- Re-send yearly or on contract renewal
What each section tests
Governance shows whether security has an owner. Access and identity checks the controls attackers abuse most: weak accounts and missing multi-factor authentication. Systems and data protection covers patching, encryption and backups. Incident management shows whether you would hear about a breach in time. Section E covers connected equipment and remote support, where a supplier's laptop can become your way in. Section F is for flow-down obligations in defense and regulated supply chains.
Common mistakes
Sending a 300-question form to every supplier produces copied answers and no insight. Accepting a certificate without checking scope is another mistake: a certificate for a head office says little about the shop that machines your parts. Finally, a questionnaire without follow-up is paperwork. Record gaps, agree remediation dates, and escalate when critical items stay open.
- Match the form to the risk
- Read certificate scope and date
- Track remediation to closure
Frequently Asked Questions
How long should a supplier security questionnaire be?
For most manufacturing suppliers, 20 to 40 well-chosen questions is enough. Longer forms get copy-pasted answers. Use the tiers: a short form for low-risk vendors and the full form for those with data or network access.
Can I accept a certificate instead of the questionnaire?
Sometimes, if the scope covers the relevant site and service and the date is current. Even then, ask the plant-floor and incident-notification questions, because certificates often do not address your specific contractual needs.
What about suppliers handling CUI or export-controlled data?
Section F asks the basic flow-down questions. Actual obligations depend on your contracts, for example DFARS and CMMC clauses, and should be reviewed with your compliance team or counsel.
How do I score the answers?
A simple approach is Yes = 2, Partial = 1, No = 0 with required evidence for critical items such as MFA and tested backups. Set a minimum score per tier and agree remediation dates with suppliers that fall short.
If you run hundreds of suppliers and want questionnaire responses summarized and compared automatically using private AI, Netray can scope that with you. The template is free as it stands.
Related Tools
Manufacturer Ransomware Readiness Assessment
A 10-question self-assessment that scores how ready a manufacturing site is to prevent, survive and recover from ransomware, including OT and ERP recovery.
Industry TemplatesManufacturing Cyber Incident Response Plan Template
A fill-in incident response plan covering roles, severity levels, containment of IT and plant floor systems, communications and recovery, exportable as a document.
Compliance & ContractsCyber Insurance Readiness Checklist for Manufacturers
A checklist of the controls and documents underwriters commonly ask manufacturers about, so you can fix gaps before the application or renewal.
Industry TemplatesOT Asset Inventory Worksheet
An editable inventory of operational technology assets with Purdue level, firmware, support status and a criticality times exposure risk score.
More Compliance & Contracts tools
See all- Used Machinery Bill of Sale Template
- Late Delivery Liquidated Damages Notice Template
- Customer Order Cancellation and Restocking Fee Notice Template
- Contract Termination for Convenience Notice Template
- Equipment Factory Acceptance Certificate Template
- Contract Redline Issue Log Worksheet
- Contract Renewal and Notice Deadline Tracker Worksheet
- Late Delivery Liquidated Damages Calculator
- Late Delivery Liquidated Damages Exposure Calculator