Take control of your third-party risk management with this professionally structured Supplier Cybersecurity Self-Assessment Questionnaire, designed to align with the principles and controls of ISO/IEC 27001.

This comprehensive Excel-based template enables organisations to systematically assess the cybersecurity posture of suppliers, contractors, and third-party service providers—helping you identify risks, ensure due diligence, and demonstrate compliance with information security standards.

What This Template Does

• Provides a structured framework to evaluate supplier security controls
• Supports compliance with ISO 27001 Annex A requirements (particularly supplier relationships and information security controls)
• Enables consistent, repeatable assessments across your supply chain
• Helps evidence due diligence for audits, certifications, and regulatory reviews

Key Features

• Supplier Information Capture: Clear onboarding section for company details, services, and risk classification
• Risk-Based Segmentation: Categorisation of suppliers (e.g. mission-critical, data-hosting, system access)
• Control-Based Questionnaire: Covers key cybersecurity domains such as:
  • Access control
  • Incident response
  • Data protection
  • Network security
  • Governance and compliance
• Scoring & Summary Sheet: Automatically aggregates responses to support risk evaluation and decision-making
• Built-in Guidance: Instructions tab ensures ease of use for both assessors and suppliers

Who This Is For

• Compliance professionals implementing or maintaining ISO 27001
• Legal and risk teams managing supplier due diligence
• SMEs building formalised third-party risk processes
• Organisations preparing for certification or audit

‍

Supplier risk is one of the most critical—and often overlooked—areas of information security. This template provides a practical, ready-to-use solution to operationalise your ISO 27001 obligations without starting from scratch.

Whether you're building a compliance framework or strengthening an existing one, this tool ensures your supplier assessments are structured, defensible, and audit-ready.