CIOPages
All RFP questions

RFP Questions · Security & Compliance

Security questions to ask a software vendor

110 security questions for the RFI, the RFP and the finalists, with scoring guidance, in one Excel workbook.

Buy the workbook, from $149Read sample questions

What this module is for

These are the security questions to put to any software vendor, whatever the product does. Add them to an RFP next to the questions about the product itself.

What it covers. Questions on how the vendor secures its product and infrastructure: secure development and penetration testing, encryption and key management, network controls, access control and MFA, and vulnerability management. AI-specific risks are in the AI safety module.

A selection usually runs in three rounds. The module has questions for each:

  • RFI, to the long list. 28 questions screen out vendors that fall short.
  • RFP, to the shortlist. 41 questions ask for detail.
  • Deep dive, to the finalists. 41 questions ask for evidence.

Each question comes with why it matters, what a good answer looks like and the red flags. The workbook scores the answers 0 to 5, weights them and totals them by round and section.

3 questions from the module

From the RFI round. The first shows part of the guide each question carries; the workbook adds follow-ups, a response format, a weight and a score column.

1. Which independent security certifications and attestations do you currently hold (e.g., SOC 2 Type II, ISO/IEC 27001, FedRAMP), and what is the renewal cadence for each?

Why it matters. Third-party attestations are the baseline evidence that a vendor's security program is independently validated rather than self-asserted. Certifications and attestations also require recurring external audit.

Good answer
  • Lists specific, current attestations with auditor and report date.
  • Offers SOC 2 Type II report under NDA without sales gating.
  • ISO/IEC 27001 certificate with statement of applicability available.
Red flags
  • Holds only self-assessments or 'in progress' certifications with no target date.
  • Refusal to share reports until late in the contract negotiation process.
  • Lapsed certifications or unclear renewal status.

2. Which cloud or hosting providers operate the production infrastructure for the product, and in which geographic regions can customer data be processed and stored?

Why it matters. Sub-processor and data residency disclosure is a baseline requirement. Buyers must align vendor hosting with their own regulatory commitments (e.g., GDPR Chapter V rules on transfers outside the EEA) and assess sub-processor concentration risk.

3. Specify the encryption algorithms, modes, and minimum key lengths used to protect customer data in transit and at rest across all service components (e.g., application, primary data stores, backups, logs, vector databases, model caches).

Why it matters. Generic 'encrypted in transit and at rest' claims are insufficient. Buyers need cipher and key specifics that match their cryptographic policies, especially for new data tiers introduced by AI products (like vector stores) that are easy to miss.

What the module covers

  • Application security & secure SDLC (26)
  • Infrastructure & platform security (35)
  • Encryption in transit, at rest & key management (16)
  • Authentication, MFA & access controls (23)

This module is one of 5 in Security & Compliance. All 5 in one workbook: $499

Questions about this module

How many security questions are there?

110: 28 for the RFI stage, 41 for the RFP and 41 deep-dive questions for the finalists.

What comes with each question?

Why it matters, what a good answer looks like, the red flags, follow-up questions, the response format, whether most buyers treat it as mandatory, and a suggested weight for scoring.

Which license do I need?

The Enterprise License covers any number of evaluations inside one organization. The Consultancy License covers use with any number of clients. Neither allows reselling or republishing the questions.

Included in these RFP packages

Each package carries this module's screening questions next to its questions about the software.

Related

Keep reading

Buyer Guide
Third-Party Risk Management (TPRM)
Checklist
Board Presentation Readiness Checklist

Ensure your IT and security presentations are board-ready.

Job 06
Secure and comply

AI agents act on systems with their own identities, and auditors and boards ask about them.