What it is
Before a firm gives a provider client data, it should know how the provider protects it. A standard questionnaire gives every vendor the same questions and gives the firm the same way to compare answers.
The form covers governance, access and data protection, operations and resilience, incidents and notification, legal and privacy terms, and ends with a scoring block for risk rating, gaps, contract terms, decision and next review date. It works for AI tools too.
When to use it
- Onboarding a new software or service provider.
- Annual review of critical vendors.
- Evaluating an AI tool before approval.
What’s inside
- Vendor and service details with data types and locations
- Five question sets with answer, details and evidence columns
- Scoring block with risk rating and decision
- Next review date
Standard cited
This template follows 16 CFR 314.4(f). It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
Why ask about independent reports?
An independent attestation or certification on the provider’s controls gives evidence beyond its own answers. Ask for scope and period, and read the report.
Does the FTC Safeguards Rule address vendors?
Yes. Covered firms must oversee service providers by choosing capable providers, requiring safeguards by contract and periodically assessing them.
What should happen with a high rating?
Add contract terms, require compensating controls, limit the data shared, or decide not to use the vendor. The scoring block records the decision.
Related templates
- Vendor Risk Register and Review Calendar (Excel)
- Written Information Security Plan (WISP) for CPA Firms
- Vendor Management and Service Organization Checklist
- AI Tool Approval Request Form
Last updated 11/05/2026. All free templates.