Free template

A vendor security questionnaire, as the spreadsheet it usually arrives in.

Thirty questions across the categories a buyer's procurement or security team asks a small supplier: company, data protection, sub-processors, transfers, AI, security, incidents, rights and complaints, continuity, insurance, attestation. Question, answer, evidence and status columns, a summary sheet, no macros. Download it; nobody asks for your email.

Download the xlsx Upload it to Rowpa instead

No signup. 8 KB. Works in Excel, Numbers, Google Sheets and LibreOffice.

Two ways to use it

As a buyer: send it to a supplier. It asks the questions that matter for a data processing relationship without pretending to be a SIG.

As a supplier: answer it once, properly, and you have a bank of answers for the next one. Or upload it to Rowpa: the data protection, sub-processor, transfer, AI and rights rows (twelve of the thirty) are drafted from your record with the evidence beside each, the security rows are marked as yours, and the approved answers are written back into this file.

What is in it

Company (2 rows)

Legal identity, registration numbers, the accountable person. The rows a reviewer checks first.

Data protection (5 rows)

Article 30 record, purposes, lawful basis, retention, the DPA. Everything a GDPR record answers directly.

Sub-processors and transfers (5 rows)

Who handles the data, on what agreement, in which country, on what transfer mechanism, and how changes are notified.

AI (2 rows)

Which tools use AI on the data, and whether any of it trains a model. The question that appeared in 2025 and is now on most sheets.

Security (8 rows)

MFA, access control, encryption, backups, patching, penetration testing, certifications, training. The rows only the supplier can answer.

Incidents, rights, continuity, insurance, attestation (8 rows)

Breach notification commitment, DSR handling, the complaints procedure, BCP testing, cyber cover, and who signs.

The columns, and why

Question as the buyer would phrase it.
Answer, free text.
Evidence / reference: the document, page or record the answer rests on. A reviewer who sees this column filled in reads the rest more kindly.
Status, a dropdown: Not started, Drafted, Needs evidence, Approved, Not applicable. The summary sheet counts them.
Owner and Notes, for the rows that belong to your developer or your accountant.

What the summary sheet tells you

How many rows are approved, how many need evidence, and how many are data protection rows: the ones a well-kept GDPR record can answer on its own. On this template that is twelve of thirty. On a real buyer's sheet it varies from a tenth to most of it, depending on whether they sent a security assessment or a data protection questionnaire.

Pricing

The template is free with no conditions. Rowpa is free to build your record and free to upload this file and read every draft; drafting the rest and writing it back into the file is £79 once, or included from Starter at £34 a month (three a year). All prices ex VAT.

Start free See all plans

Common questions

Can I change the questions?

Yes. It is a plain xlsx with no protection. Add, remove or reword rows; the summary sheet counts whatever is there.

Is this a SIG Lite or CAIQ?

No. Those are licensed forms with hundreds of rows, and if a buyer sends one you should answer that one. This is the shorter sheet a mid-sized buyer sends a small supplier. Rowpa reads SIG, CAIQ, HECVAT, the Scottish SAQ and Cyber Essentials layouts too.

If I upload it to Rowpa, what comes back?

The same file, with the data protection rows drafted and the evidence column filled with the source in your record, the status column set to Drafted for those rows, and everything else untouched. You review and approve before anything is written.