New: VSA Questionnaire 2027

The vendor security questionnaire, rebuilt for AI, resilience and privacy.

The Vendor Security Alliance is a coalition of companies committed to improving Internet security. Our free questionnaires give every company one standard way to assess a vendor. The 2027 editions are the biggest update since the first release in 2016.

Get the questionnaires Join the VSA

Free to use for assessing your own vendors. Registration required.

2027 at a glance	CORE	FULL
Questions, at most	122	278
Sections	21	21
AI questions	13	39
Privacy regions	4	4
Formats	Excel workbook and web questionnaire

Two editions, one question bank

Choose the depth that fits the risk

Every CORE question appears word for word in FULL, so a vendor who has answered CORE can carry those answers straight into FULL. Scoping questions at the start switch off sections that do not apply, so most vendors see fewer questions than the maximum.

VSA CORE 2027

122 questions at most

The essentials

The most important questions from every section of FULL
For lower-risk services, or a first pass before a deeper review
Covers security, AI and privacy

VSA FULL 2027

278 questions at most

The in-depth assessment

For services that handle sensitive data or are critical to your operations
Deeper coverage of every section, including software supply chain and AI security
Privacy modules are now part of FULL as well as CORE

What's new in 2027

Updated for how vendors work now

AI and your data

Three new sections ask whether customer data trains any model, how AI is governed, and how AI features are secured against prompt injection and over-permissioned agents.

Resilience

Business continuity, recovery objectives, immutable backups, restore testing and recovery from ransomware now have their own section.

Privacy in four regions

A global baseline plus modules for the EU, EEA and UK, the United States, the Philippines and India. Vendors only see the regions that apply.

Sub-processors and exit

Sub-processor lists and change notice, fourth-party visibility, and how data is returned and deleted when a contract ends.

Current practice

Identity, cloud, software supply chain and incident notification questions have been rewritten. Outdated questions, including Privacy Shield, are retired.

Two formats

An Excel workbook with dropdown answers and progress tracking, and a web questionnaire that keeps answers in the vendor's own browser until they save a file.

Service Overview & Scoping
Data Inventory
Governance, Policies & Personnel
Identity & Access Management
Data Protection & Cryptography
Infrastructure, Cloud & Tenant Isolation
Vulnerability Management & Security Testing
Secure Development & Software Supply Chain
Detection, Incident Response & Notification
ResilienceNEW
Sub-processors, Fourth Parties & ExitNEW
Customer-Facing Application Controls
AI: Customer Data & TrainingNEW
AI: GovernanceNEW
AI: SecurityNEW
Privacy: Global Baseline
Privacy: EU / EEA / UK
Privacy: United States
Privacy: PhilippinesNEW
Privacy: IndiaNEW
Assurance & Track Record

Free download

Get the 2027 questionnaires

Free for evaluating your own security and your direct vendors
Your links are personal and work for 14 days; register again any time for fresh ones
Reviewer weights included as guidance, with no automated score

Licence terms

Disclaimer and Limited License Grant. The Vendor Security Alliance (VSA) questionnaire and all related material (the “Licensed Material”) is provided AS IS, with no representations or warranties of any kind, whether express, implied, statutory, or other. This includes, without limitation, warranties of title, merchantability, fitness for a particular purpose, non-infringement, absence of latent or other defects, accuracy, or the absence of errors, whether or not known or discoverable. VSA and its members will have no liability under any legal theory (including, without limitation, negligence) or otherwise for any direct, special, indirect, incidental, consequential, punitive, exemplary, or other losses, costs, expenses, or damages arising out of use of the Licensed Material, even if advised of the possibility of such losses, costs, expenses, or damages.

VSA grants a limited right, under its copyright rights in the Licensed Material, for users of the Licensed Material to download a copy of the Licensed Material and reproduce and distribute unmodified copies for sole purpose of (a) a particular user evaluating its own internal security processes and the security practices of its direct vendors, or (b) providing Feedback to VSA. All other uses are prohibited (including, without limitation, using the Licensed Material in connection with a security consulting or hosted vendor management service), and no additional intellectual property rights are granted by VSA to any party. “Feedback” means any suggested changes to the Licensed Material. VSA will have the right to reproduce, distribute, perform, display and create derivative works of all Feedback, and use all Feedback without restriction and without payments to any party.

Mission

A shared standard for vendor security

Every day, industries across the globe depend on each other to embrace sound cybersecurity practices, yet companies have not had a standardised way to assess the security of their peers. The VSA was formed to solve this and to streamline vendor security compliance.

Working with the VSA, security experts and experienced compliance officers produce a questionnaire that companies can use to qualify vendors and confirm that appropriate controls are in place, improving security for everyone.

Insecure vendors are a common cause of data breaches, and regulators expect companies to carry out risk-based analysis of their vendors' security practices. The VSA questionnaire is designed to support that work.

The VSA is organised as a non-profit. The first questionnaire was released on 1 October 2016.

Companies