How to write the account questions in a vendor security questionnaire

Write the account questions in a vendor security questionnaire around the accounts you gave the vendor. For each answer, ask who checks it, how often and against what record. Tie each question to the rule or framework item it serves. Then check the answers against your own records and a live walkthrough. For what a security questionnaire is and why companies send one, see What is a security questionnaire?

What to settle before writing questions

Start with a list of the accounts you’ve given this vendor. One line each: vendor, system, account, how you handed it over (a user account for each person, a shared login, or an access tool), and who uses it. Phrases such as “the user accounts we created for you” or “the shared login we provided for our billing portal” come from this list. Without it, the questions turn generic, and so do the answers.

Then split the answer into three columns: the current state, how it’s checked (who, how often, against what record), and planned fixes (date and owner). If the current state and plans share one column, a later audit can’t tell whether an answer was wrong or a fix was late.

Ten sample questions

Each question names the rule or framework item it serves and what a usable answer looks like. The FTC Safeguards Rule (16 CFR Part 314) applies to financial institutions under the FTC’s authority. The California Consumer Privacy Act (CCPA) applies to for-profit companies doing business in California that meet at least one of its thresholds. One is annual gross revenue over $25 million, adjusted for inflation (Cal. Civ. Code 1798.140(d)). NIST’s Cybersecurity Framework (CSF) 2.0 is guidance for organizations of all sizes and sectors, and NIST’s SP 800-53 is a catalog of controls any company can borrow from. If you send the Cloud Security Alliance’s CAIQ, which is now built into its Cloud Controls Matrix (CCM) v4.1, these questions sit beside its Identity & Access Management domain.

1. List the name, team and role of each person who uses the user accounts we created for you. This serves CSF 2.0 PR.AA-01, identities and credentials managed by the organization. A usable answer is a roster you can match to your own user list.
2. Who updates that roster, and when (at every staff change, monthly)? This serves PR.AA-05, which asks for access to be managed and reviewed. A usable answer names the person and the timing.
3. Can anyone not on the roster get into our accounts? The FTC rule requires you to permit access only to authorized users (314.4(c)(1)(i)). A usable answer explains why not: each person has their own user account, or only named people know a shared password.
4. For the shared login we provided for [system], name everyone who knows the username and password. This also serves PR.AA-01. A usable answer is a list of names for each shared account.
5. When was that password last changed, and what is the process when someone who knows it leaves? SP 800-53 control AC-2 asks for a process to change shared account passwords when people are removed from the group (AC-2k). A usable answer names who asks you for the change and who gets the new password.
6. When a person on our work leaves or moves, who tells us, and by when? SP 800-53 control PS-7 asks you to require external providers to notify you of such transfers and terminations (PS-7d). A usable answer gives the person, the deadline and the steps until you disable the user account.
7. Where do you record who used our systems and when (work log, ticket history), and for how long? The FTC rule requires controls to monitor and log the activity of authorized users (314.4(c)(8)). A usable answer gives the format, the retention period, and whether it can be matched to our sign-in records.
8. Are the computers used in our accounts company-issued? If personal, how do you stop passwords being saved and our data being downloaded? NIST SP 1300 asks whether you have acceptable use policies for employee-owned devices that reach business resources. A usable answer names who manages the devices and the controls.
9. Do you pass any of our work to another firm or person? If so, which of our accounts do they use? Under the CCPA, a service provider that brings in another person to process the personal information it handles for you must tell you. It must also bind that person by written contract (Cal. Civ. Code 1798.140(ag)(2)). A usable answer names the subcontractor, the work and the accounts.
10. When you learn of a suspicious sign-in or a leaked password for our accounts, who reports it to us, and by when? CSF 2.0 GV.SC-08 includes suppliers in incident planning and response. A usable answer gives the contact, the deadline and the channel.

Ask questions 4 and 5 only where you handed over a shared login. If every person has their own user account, question 3 settles it. If the vendor says its team shares one login, see What to check when a vendor says its team uses one shared login. For question 9, see How to see which subcontractor workers use your accounts.

How to read the answers

Start with the answers you can check yourself. Match the roster in question 1 against the user accounts you created, and the record in question 7 against your own sign-in records. A user account with no matching name means the vendor missed a report or the roster is out of date. Treat that question as unanswered until you know which.

Accept as the current state only answers that say who checks, how often and against what record. Accept planned fixes only with a date and an owner, and keep them in their own column.

Checking answers live

Written answers alone are only the vendor’s word. The FTC rule requires you to assess vendors periodically based on the risk they present (314.4(f)(3)). Under the CCPA, your contract with the vendor may let you monitor it through assessments, audits or testing at least once every 12 months (1798.140(ag)(1)).

Check live only what paper can’t support:

• where the shared password from question 4 is written down, and who can see it
• whether the computers from question 8 hold saved passwords or downloaded files
• whether the record from question 7 exists in the form the answer describes

A vendor can show all three on a screen-share.

When to send it again

At each scheduled review, send the same full set, so you can compare answers with last time. Between reviews, send just the questions whose facts changed: the roster, the date of the last password change, and subcontractors. Do this when the vendor reports a staff change or a new subcontractor. Do it too when you find a user account in your systems that isn’t on the roster.