Security Questionnaires: Assessing and Managing Vendor Risks

**Executive Summary:** This guide explains why security questionnaires remain a core component of third-party risk management and presents six best practices for gaining vendor visibility, selecting or customizing questionnaires, monitoring progress, leveraging technology to streamline evidence collection, validating responses, and providing feedback; it also discusses common challenges of legacy processes and advocates integrating questionnaire data with continuous monitoring solutions like SecurityScorecard’s SCDR to improve vendor oversight and reduce supply-chain risk.