Free resource
Security questionnaire question library
Every question in our library — 256 real security questionnaire questions grouped by topic, each with an expert answer your security or GRC team can adapt.AI & ML questions (55)
Do you use any AI or machine learning in your product?How do you handle customer data used in AI features?Do you use third-party AI APIs (OpenAI, Anthropic, etc.)?What data is sent to AI service providers?Do you have an AI acceptable use policy?How do you prevent sensitive data from being included in AI prompts?Can customers opt out of AI features processing their data?Do AI vendors have access to customer data?How do you handle AI-generated content in your product?What measures prevent AI from leaking data between customers?Do you log AI interactions for audit purposes?How do you ensure AI outputs are accurate?What is your policy on AI training using customer data?Do you disclose when content is AI-generated?How do you handle AI service provider outages?What human review exists for AI-generated outputs?Do you use AI for any automated decision-making?How do you manage AI API keys and credentials?What is your AI data retention policy?Do you have terms of service covering AI features?What controls prevent AI hallucinations from affecting business decisions?How do you monitor AI system outputs for accuracy and bias?What is your AI model versioning and rollback process?How do you validate AI vendor security certifications?What human oversight exists for AI-driven decisions?How do you ensure AI training data does not contain PII?What is your policy on AI-generated content attribution?Do you log AI interactions for compliance purposes?How do you handle AI service degradation?What is your AI ethics policy?Do you perform regular AI model audits?How do you handle customer requests to delete AI training data?What AI risk assessments do you perform?How do you ensure AI vendor compliance with your security standards?Do you have SLAs for AI service availability?What testing do you perform on AI outputs?How do you document AI system behavior?What is your AI/ML model governance framework?How do you ensure AI outputs comply with data residency requirements?What safeguards exist against adversarial attacks on AI systems?How do you audit AI system decisions for regulatory compliance?What is your AI incident response and notification process?How do you ensure AI transparency and explainability for regulators?What is your process for AI model retirement and data disposal?Do you have an AI ethics board or review committee?How do you handle regulatory inquiries about AI systems?What AI risk quantification methods do you use?Do you support customer-specific AI model isolation?How do you ensure AI model provenance and supply chain security?What third-party AI audits have you completed?How do you handle AI-related legal discovery requests?Do you provide AI model cards for transparency?How do you prevent prompt injection attacks in your AI features?How do you evaluate the security of a new AI model or provider before adoption?Do your AI features use retrieval-augmented generation (RAG), and how are access controls enforced on retrieved content?
Data security questions (50)
Do you encrypt data at rest and in transit?How do you handle customer data deletion requests?Do you maintain an inventory of all customer data?What is your data backup and recovery process?How do you secure data in development environments?Do you have a privacy policy that covers customer data usage?Where is customer data stored geographically?How long do you retain customer data?What encryption algorithms do you use?How do you protect database credentials?Do you use production data in test environments?How do you handle data export requests?What logging exists for data access?Do you have a data breach notification process?How do you secure file uploads?What data sanitization methods do you use?Do you support data portability?How do you secure API communications?Do you use secure delete methods for data disposal?How do you protect data in transit between services?Do you have a data classification policy?What DLP (Data Loss Prevention) controls do you have?How do you handle secure key management?What encryption standards do you use (AES-256, TLS 1.3, etc.)?How do you ensure data integrity and prevent tampering?What is your data retention and disposal policy?How do you handle data subject access requests (DSARs)?Do you have data flow diagrams for customer data?What data masking capabilities do you offer?Do you support data encryption key rotation?How do you secure database backups?What data access logging do you maintain?Do you have data breach notification procedures?How do you handle data sovereignty and residency requirements?How do you handle cross-border data transfers?What is your approach to privacy by design?Do you support customer-managed encryption keys (BYOK)?How do you ensure data isolation in multi-tenant environments?What data lineage and provenance tracking do you provide?How do you handle data anonymization and pseudonymization?Do you support Hardware Security Modules (HSM)?What data tokenization capabilities do you offer?How do you handle legal holds and e-discovery?Do you provide immutable audit logs?What is your data residency guarantee for specific regions?How do you handle data subject rights at scale?Do you support customer-defined data retention policies?What certifications do you have for data handling (ISO 27001, etc.)?How long do you retain customer data after contract termination?Is production customer data ever used in testing or non-production environments?
Access control questions (46)
Is multi-factor authentication (MFA) required for all users?What is your password policy?How do you handle employee offboarding?Do you perform background checks on employees?How do you manage access to production systems?Do you support single sign-on (SSO) for customers?How do you manage admin account security?What role-based access controls exist?How do you handle shared account usage?Do you have session timeout policies?How do you secure remote access?What authentication methods do you support?Do you log authentication events?How do you handle account lockouts?Do you support IP-based access restrictions?How do you manage API access tokens?What is your password reset process?Do you support customer-defined access policies?How do you prevent unauthorized access?Do you have different permission levels for users?What access control model do you use (RBAC, ABAC)?How do you manage privileged access (PAM)?Do you perform regular access reviews and certifications?How do you handle service account and API key management?What session management controls are in place?Do you support SCIM provisioning for user management?How do you implement the principle of least privilege?How do you handle temporary access grants?Do you provide access audit trails?How often do you rotate credentials?Do you support IP allowlisting?What is your approach to zero-trust architecture?Do you support SAML 2.0 and OIDC for enterprise SSO?How do you handle just-in-time (JIT) access provisioning?What identity governance and administration (IGA) controls exist?How do you integrate with enterprise identity providers?What conditional access policies do you support?How do you handle federated identity across organizations?Do you support break-glass emergency access procedures?How do you handle cross-tenant access controls?Do you support fine-grained authorization policies?What access request and approval workflows exist?How do you handle delegated administration?Do you integrate with security information event management (SIEM)?What access analytics and anomaly detection do you provide?How do you manage contractor and temporary worker access?
Infrastructure questions (51)
Where is your infrastructure hosted (AWS, GCP, Azure)?Do you use a web application firewall (WAF)?How do you protect against DDoS attacks?Do you have logging and monitoring in place?How do you secure your CI/CD pipeline?What vulnerability scanning do you perform?Do you have an uptime SLA?What is your disaster recovery plan?How do you handle infrastructure updates?Do you use container security scanning?How do you secure your code repositories?What network segmentation exists?How do you manage SSL/TLS certificates?Do you have intrusion detection systems?How do you handle server hardening?What is your patch management process?Do you perform regular security scans?How do you secure cloud storage buckets?What backup systems are in place?How do you monitor for security incidents?How do you segment your network architecture?What endpoint detection and response (EDR) solutions do you use?Do you have a Security Operations Center (SOC)?What is your patch management policy and SLA?How do you ensure secure configuration management?What is your vulnerability scanning frequency?What is your mean time to detect (MTTD) and respond (MTTR)?Do you have intrusion detection and prevention systems?How do you secure cloud storage?What is your infrastructure change management process?Do you support private cloud or on-premises deployment?How do you ensure supply chain security for infrastructure?What is your approach to infrastructure as code security?Do you support VPC peering or private link connectivity?How do you handle multi-region disaster recovery?What threat intelligence do you integrate with your SOC?How do you ensure secure multi-tenant architecture?Do you offer dedicated infrastructure options?What is your approach to software bill of materials (SBOM)?Do you support customer security tooling integration?What red team and purple team exercises do you conduct?How do you handle infrastructure forensics?Do you have FedRAMP or StateRAMP authorization?What is your RTO and RPO for disaster recovery?How do you ensure infrastructure compliance across regions?Do you support customer-managed infrastructure components?How do you secure employee endpoints (EDR, disk encryption, MDM)?Do you follow a secure software development lifecycle (SSDLC)?How are secrets and credentials stored in your production environment?How often do you test your business continuity and disaster recovery plans?What email security controls (SPF, DKIM, DMARC) do you have in place?
Compliance questions (54)
Do you have a formal Information Security Policy?Do you have a documented incident response plan?What security awareness training do employees receive?Do you have a business continuity plan?Do you have cyber insurance coverage?How do you manage third-party vendor risk?Do you have a responsible disclosure policy?What is your change management process?Do you have documented security procedures?How often do you review security policies?Do you have a data protection officer?What compliance certifications are you pursuing?How do you handle security incidents?Do you conduct internal security audits?What is your risk management approach?Do you have an acceptable use policy?How do you handle customer security inquiries?Do you have secure software development practices?What is your employee onboarding security process?Do you have asset management procedures?Are you SOC 2 Type II certified?Do you conduct regular penetration testing?Do you perform regular security risk assessments?Do you have a formal vendor security assessment process?How do you handle security exceptions and risk acceptance?Do you have a vulnerability disclosure policy?What compliance frameworks do you follow?Do you have security metrics and KPIs?What is your employee security onboarding process?How do you handle security incident communication?Are you ISO 27001 certified?Do you comply with GDPR requirements?Do you have a formal security governance framework?Do you have a CISO or equivalent security leadership role?Do you conduct tabletop exercises for incident response?How do you ensure compliance with industry-specific regulations?What is your approach to security metrics and KPIs?Do you participate in industry information sharing (ISACs)?Do you support customer compliance audits?What regulatory certifications do you maintain?How do you handle regulatory examinations?Do you have a dedicated compliance team?What third-party security assessments have you completed?How do you handle contractual security requirements?Do you provide security questionnaire pre-fill or automation?What is your approach to continuous compliance monitoring?How do you handle security audit findings and remediation?Do you use subprocessors, and how are customers notified of changes?Is your SOC 2 report Type I or Type II, and how can customers obtain it?Do you offer a Data Processing Agreement (DPA) with Standard Contractual Clauses?Can you share your most recent penetration test report or summary?What are your incident response SLAs by severity level?Do you conduct Data Protection Impact Assessments (DPIAs)?Do you comply with CCPA/CPRA requirements?