Lightweight Supplier Due Diligence Questionnaire

Here is a modernised lightweight supplier due diligence questionnaire based on the uploaded version, incorporating updates for GDPR, DORA (Digital Operational Resilience Act), and other relevant cybersecurity and data protection standards. This questionnaire is designed for low-risk suppliers who do not have access to internal systems or confidential data but still require a basic level of security assurance.

Download a excel version

Section 1: Supplier Information

1. Supplier Name:

2. Company Registration Number:

3. Country of Registration:

4. Primary Business Contact:

   • Name:

   • Email:

   • Phone Number:

5. Website URL:

6. Brief Description of Services Provided:

7. Does the supplier use subcontractors for any services? (Yes/No)

   • If yes, please provide details.

Section 2: Information Security Policies & Governance

8. Does the organisation have a formal, documented information security policy? (Yes/No)

   • If yes, please provide a summary or attach relevant documentation.

9. Is there a dedicated person responsible for security oversight (e.g., CISO, Security Manager)? (Yes/No)

   • If yes, please provide their name and role.

10. Has the organisation implemented a cybersecurity framework such as ISO 27001, NIST, or Cyber Essentials? (Yes/No)

• If yes, please specify which framework and provide certification details.

Section 3: Data Protection & Privacy Compliance

11. Does the organisation process, store, or transmit any personal data? (Yes/No)

• If yes, please specify the type of data processed.

12. Is the organisation compliant with GDPR or any other applicable data protection regulations? (Yes/No)

• If yes, please provide details of compliance measures.

13. Does the organisation have a Data Protection Officer (DPO) or equivalent role? (Yes/No)

14. Are employees trained on data protection and privacy regulations? (Yes/No)

15. Are data retention and disposal policies in place? (Yes/No)

• If yes, please provide a brief overview.

Section 4: Personnel Security

16. Are background checks performed on employees with access to sensitive information? (Yes/No)

17. Do employees receive cybersecurity awareness training? (Yes/No)

18. Do employees sign confidentiality agreements or non-disclosure agreements (NDAs)? (Yes/No)

Section 5: Physical Security

19. Does the organisation operate from a secure physical location with access controls? (Yes/No)

20. Are visitors required to sign in and be escorted in restricted areas? (Yes/No)

Section 6: IT Security Controls

21. Does the organisation enforce password policies, including multi-factor authentication (MFA)? (Yes/No)

22. Are all company devices protected by antivirus software and regularly updated? (Yes/No)

23. Does the organisation maintain up-to-date software and security patches? (Yes/No)

24. Are cloud-based services used, and if so, which provider(s) (e.g., AWS, Azure, Google Cloud)?

25. Does the organisation conduct security monitoring and logging of system access? (Yes/No)

Section 7: Incident Management & Business Resilience

26. Does the organisation have an incident response plan in place? (Yes/No)

27. Has the organisation experienced any data breaches or cybersecurity incidents in the last 12 months? (Yes/No)

• If yes, please provide a brief summary of the incident and resolution steps taken.

28. Does the organisation have a business continuity and disaster recovery plan? (Yes/No)

29. Are data backups performed and tested regularly? (Yes/No)

Section 8: Compliance with DORA (Digital Operational Resilience Act)

30. For financial services providers or suppliers operating within the EU, are you compliant with DORA’s ICT security risk management requirements? (Yes/No)

• If yes, please provide an overview of key security controls implemented.

31. Do you conduct regular risk assessments to evaluate digital resilience? (Yes/No)

32. Do you have a mechanism to report major cyber incidents to regulators or affected clients? (Yes/No)

Section 9: Third-Party Dependencies

33. Do you conduct due diligence on your own suppliers and subcontractors? (Yes/No)

34. Do you have contractual agreements in place to ensure your suppliers adhere to security best practices? (Yes/No)

Certification & Attestation

By completing this questionnaire, the supplier confirms that the information provided is accurate to the best of their knowledge.

Name:
Position:
Date:

Conclusion

This questionnaire is designed to provide a baseline security assessment for low-risk suppliers. Responses should be reviewed alongside any publicly available cybersecurity policies and independent verification where necessary.