Vendor Security Questionnaires in Australia: How to Answer Them and the Evidence Clients Expect

A vendor security questionnaire is a client's way of checking whether you're safe to trust with their data, systems or customers before they sign or renew. Answer it well by giving honest, specific answers, backing every "yes" with evidence such as policies, screenshots, an independent penetration test summary or an Essential Eight assessment, and flagging gaps with a dated plan rather than hiding them. Clients don't expect perfection. They expect answers they can rely on, because your answers often end up in the contract.

This guide explains why Australian clients are sending more security questionnaires, what they usually ask, how to answer them without overclaiming, and what evidence actually satisfies a reviewer. It's written for Australian SMBs, SaaS providers and service firms that keep getting a spreadsheet from a bigger customer and want to stop scrambling every time.

What is a vendor security questionnaire?

A vendor security questionnaire (also called a supplier security questionnaire or third-party risk assessment) is a structured set of questions a customer sends to a supplier to assess its cyber security controls before or during a contract. It's part of the customer's due diligence on its supply chain.

They come in a few common shapes:

▸The client's own spreadsheet: dozens to hundreds of yes/no and free-text questions, often built by their risk or procurement team
▸A standardised industry questionnaire: frameworks such as the Cloud Security Alliance's CAIQ or the Shared Assessments SIG, often used by larger organisations and SaaS buyers
▸A procurement or tender schedule: a security section inside a government or enterprise tender, usually asking about frameworks, testing and incident handling
▸A portal-based assessment: a third-party risk platform where you upload documents and answer questions online

Whatever the format, the reviewer is trying to answer one question: if we connect this supplier to our data or systems, what's the chance it becomes our breach?

Why are Australian clients sending more security questionnaires?

Because Australian law, regulators and government guidance increasingly hold organisations responsible for the risk their suppliers introduce. When a client sends you a questionnaire, they're usually meeting an obligation of their own.

The Privacy Act and the NDB scheme

Under Australian Privacy Principle 11, businesses covered by the Privacy Act must take reasonable steps to protect the personal information they hold. If they hand that information to a supplier, the risk doesn't disappear. Reporting on its January to June 2025 breach statistics, the OAIC described a case where a software developer engaged by a government agency ran an unauthorised script that exposed private documents online, and reminded organisations that they are responsible for the actions of their third-party providers.

Breaches are also at record levels. The OAIC received 1,205 data breach notifications in calendar year 2025, the highest since the Notifiable Data Breaches scheme began in 2018, with 716 attributed to malicious or criminal activity. Our guide to Privacy Act cyber security requirements covers APP 11 in more detail.

APRA CPS 234 and CPS 230

If your client is a bank, insurer or super fund, the questionnaire is likely driven by APRA. CPS 234 requires regulated entities to assess the information security capability of any related or third party that manages their information assets, commensurate with the potential consequences of an incident. When APRA reviewed CPS 234 compliance, one of the most common gaps was limited assessment of third-party information security capability, with control effectiveness often based on a supplier's self-assessment alone.

CPS 230 Operational Risk Management, in force since 1 July 2025, adds obligations around material service providers. If you supply an APRA-regulated entity, expect the questions to get more detailed. See our guide to CPS 234 penetration testing.

SOCI, DISP and government supply chains

Critical infrastructure owners covered by the SOCI Act must manage supply chain hazards in their risk management programs, and Defence primes push DISP expectations down to subcontractors. Our guides to SOCI Act cyber security requirements and DISP cyber security requirements explain both.

ASD's guidance on identifying cyber supply chain risks gives organisations a list of questions to ask suppliers, including whether the supplier follows a cyber security standard, whether penetration testing can be conducted on its products and services, whether it will share the results of previous assessments, and whether contracts include incident reporting and a right to audit. Many client questionnaires borrow directly from that thinking.

The cost of getting it wrong

The money involved is real. ASD's Annual Cyber Threat Report 2024–25 puts the average self-reported cost of cybercrime per report at $56,600 for small businesses and $97,200 for medium businesses. A client that suffers a breach through a supplier carries that cost, and the reputational damage, so they want evidence up front.

What do security questionnaires usually ask?

Most questionnaires cover the same eight areas, whatever their length or format. If you prepare answers and evidence for each, you'll be ready for most of what lands in your inbox.

Governance and policies

▸Do you have a documented information security policy, and who owns it?
▸Do you follow a recognised framework such as the Essential Eight, ISO 27001 or NIST?
▸When were your policies last reviewed and approved?

Identity and access

▸Is multi-factor authentication enforced for email, remote access, admin accounts and cloud services?
▸How do you manage privileged accounts and remove access when staff leave?
▸Do you use single sign-on, and is access reviewed regularly?

Patching and vulnerability management

▸How quickly do you patch critical vulnerabilities in internet-facing systems?
▸Do you run regular vulnerability scanning?
▸Do you still run any unsupported operating systems or software?

Security testing

▸Have you had an independent penetration test in the last 12 months?
▸What was in scope, and have critical and high findings been fixed?
▸Will you share a summary of the results?

Data protection

▸Is data encrypted in transit and at rest?
▸Where is data stored, and is any of it held or accessed offshore?
▸How are backups protected and tested?

Incident response and notification

▸Do you have a documented, tested incident response plan?
▸How quickly will you notify us of an incident affecting our data?
▸Have you had a breach in the last few years?

Suppliers and subcontractors

▸Which subprocessors or subcontractors can access our data?
▸How do you assess their security?

People

▸Do staff complete security awareness training, including phishing awareness?
▸Do you run background checks for staff with privileged access?

How should you answer a vendor security questionnaire?

Answer accurately, answer once, and make every answer traceable to evidence. The fastest teams treat questionnaires as a repeatable process, not a fresh fire drill for every client.

Clarify scope before you start. Ask which systems, services and data the client is actually assessing. A questionnaire about your SaaS platform shouldn't drag in your office printer.
Build an answer library. Keep approved answers to common questions in one place, with an owner and a review date. Reuse them so every client gets the same truth.
Answer what is true today. Not what's planned, not what your MSP said in 2023. If a control is partly in place, say so.
Use "partial" with a plan. A partial answer with a compensating control and a target date (for example, phishing-resistant MFA rolling out to admins by a set month) is far more credible than a hopeful "yes".
Attach or offer evidence. Policies, configuration screenshots, a pentest executive summary, an Essential Eight assessment report or an insurance certificate.
Get technical review before sign-off. Someone who understands your environment, internal or external, should check technical answers before a director signs the response.
Track your commitments. Promises in a questionnaire often become contract clauses. Diarise them.

What not to do

▸Don't answer "yes" to "MFA everywhere" when legacy protocols or a shared admin account still bypass it
▸Don't describe yourself as "Essential Eight certified". There's no such certification. You can say you've been assessed at a stated maturity level, on a stated date
▸Don't attach a pentest report that's years old or covers a different system
▸Don't let different staff give different clients different answers to the same question

What evidence do clients actually accept?

Reviewers trust evidence that's independent, recent and specific to the systems in scope. A policy proves intent. A test proves the control works.

ASD's Essential Eight Assessment Process Guide makes the same point for Essential Eight assessors: testing a control with a simulated activity is rated "excellent" evidence, a configuration review is "good" or "fair", and a policy or statement of intent is "poor". Sophisticated questionnaire reviewers think the same way.

Question	Weak evidence	Strong evidence
Is MFA enforced?	"Yes" with no detail	Conditional access policy export plus an independent test showing no bypass
Do you patch promptly?	Patch policy document	Patch reports and a recent vulnerability assessment
Independent pentest in 12 months?	Internal scan output	Executive summary or attestation from a dated, scoped external test
Which framework do you follow?	"We align to Essential Eight"	Essential Eight assessment report with maturity level and date
Incident response?	Plan exists	Plan plus a record of a recent tabletop exercise

Can you share your penetration test report?

Usually you share a summary, not the full report. A full pentest report contains detailed exploitation steps that could help an attacker if it leaks. Most clients are satisfied with:

▸an executive summary or attestation letter stating the test dates, scope, methodology and tester
▸a severity breakdown of findings
▸confirmation that critical and high findings have been remediated or retested
▸the full report under NDA, only if the client genuinely needs it

Our guide to what a penetration testing report includes shows how to use each section.

If a big client is waiting on a questionnaire right now, book a 1-on-1 call with us. We'll look at what they're asking and tell you which evidence will actually close the gaps.

Does a security questionnaire mean you need a penetration test?

Not always, but if the questionnaire asks for independent testing in the last 12 months and you don't have it, you'll either answer "no" or go and get one. Testing is one of the most commonly requested pieces of evidence because it's the only one that shows what an attacker could actually do.

Whether you need a full engagement depends on what the client is buying from you:

▸You host or process their data (SaaS, platform, portal): expect to need a web application and API penetration test of the in-scope platform
▸You connect to their network or hold privileged access (MSP, IT contractor): expect questions on your internal network, identity and remote access tooling
▸You handle their personal information in email and documents (professional services): expect a focus on Microsoft 365, MFA, email security and endpoint controls, where an Essential Eight assessment often fits well

A vulnerability assessment is not the same as a penetration test, and a good reviewer will notice if you describe a scan as a pentest. Be precise about what you had done.

Which Aussie Pentest service fits your questionnaire?

Match the service to the evidence gap, not the other way round. Here's how our services line up with common questionnaire requests. All prices are from our pricing page, in AUD + GST.

Questionnaire gap	Best fit	Price
Need a quick, analyst-reviewed baseline of a website or app	Automated security assessment (not a pentest)	$80 to $2,000
"Independent penetration test in the last 12 months"	Human-led penetration test with written scope and proof-of-concept evidence	From $5,000, $12,000 or $20,000 by tier
"Which framework do you follow, and at what maturity?"	Essential Eight assessment against ML1 or ML2	$4,950 fixed fee up to 50 seats
Questionnaires keep arriving and nobody owns them	vCISO retainer for advisory, risk register and board reporting	$2,500 to $6,500 per month
You're an MSP whose clients are being asked	White-label testing under your brand	Partner rate card

The automated assessment is a useful first step, but it doesn't replace a manual penetration test when a questionnaire explicitly asks for one. Our automated vs manual penetration testing guide explains the difference.

What about our MSP?

Your MSP may run your IT well, but answers about the controls they built are stronger when someone independent has checked them. That isn't about replacing your MSP. It's about validating what they built, so you can sign the questionnaire with confidence.

How do you get ahead of the next questionnaire?

Build a small "trust pack" once and refresh it on a schedule. Most of the effort in questionnaires goes into hunting for evidence that should already exist.

A practical trust pack for an SMB includes:

▸a one-page security overview: frameworks followed, key controls, contacts
▸your information security and acceptable use policies, with review dates
▸your latest penetration test executive summary and retest confirmation
▸your latest Essential Eight assessment summary, if you have one
▸your incident response plan summary and notification commitment
▸a list of subprocessors and where data is stored
▸your cyber insurance certificate of currency, if you're comfortable sharing it

Review it at least annually and after any major change, such as a new platform, a migration to the cloud or a merger. Our guide to how often to get a penetration test helps set the testing cadence.

Frequently asked questions

How long does it take to complete a security questionnaire?

It depends on the length of the questionnaire and how organised your evidence is. A short questionnaire with a ready trust pack might take an afternoon, while a first long questionnaire without existing evidence can take much longer, because the work is finding and verifying answers rather than typing them.

Can we refuse to complete a vendor security questionnaire?

You can, but it usually ends the deal or the renewal, especially with regulated clients who need the answers for their own obligations. A better option is to offer your trust pack and ask whether it covers their needs, or to request a call to agree on scope.

Does ISO 27001 or SOC 2 replace a questionnaire?

Often it shortens one, because many clients will accept a certificate or report in place of large sections. It rarely removes the questionnaire entirely, and clients still commonly ask about penetration testing. See our guides to ISO 27001 penetration testing and SOC 2 penetration testing.

We're under $3 million turnover. Do questionnaires still apply to us?

Yes. The Privacy Act small business exemption doesn't stop your client from asking. If they're covered by the Privacy Act, APRA or the SOCI Act, their obligations flow to you through the contract regardless of your size.

Should we let our MSP fill in the questionnaire?

Your MSP should help with technical answers, but your business owns the response and usually signs it. Review their answers, ask for evidence, and consider independent testing so the answers don't rest on one party's word.

Bottom line

A vendor security questionnaire is a test of trust, not a form. Answer honestly, back every "yes" with recent evidence, explain gaps with a plan, and keep a trust pack ready so the next one takes hours instead of weeks. Independent evidence, such as a scoped penetration test or an Essential Eight assessment, is what turns your answers from claims into proof.

At Aussie Pentest we help Australian businesses build that evidence, with fixed-fee penetration testing from $5,000 + GST, Essential Eight assessments for $4,950 + GST and vCISO retainers for teams that want someone to own security reporting. Book a 1-on-1 call and bring the questionnaire with you.

Sources

This article is general information only, not legal, compliance or procurement advice. Questionnaire requirements are set by each client and their regulators, so confirm what applies to you with the client or a qualified adviser. Prices are current as of October 2026, and OAIC, APRA and ASD sources were checked on 22 October 2026. Aussie Pentest does not certify Essential Eight compliance, and our reports support your answers but don't guarantee a client will accept them. Only test systems you have written authority to assess.