cyberaffinity

Free tool

VendorProof

Find out how much scrutiny a vendor deserves, send them a security questionnaire sized to match, and turn their answers into a score, red flags and a clear approve-or-reject decision.

🔒 Everything stays in this browser — nothing is uploaded. Back up to a file if you want to keep or share it.

🔒 Saved only in this browser.

How it works

  • 1. Quick check. Eight questions about what the vendor will touch and what they can show you set an inherent risk tier: Low, Medium, High or Critical. Questions 1–3 measure impact; missing assurance in questions 4–8 can raise the tier one level.
  • 2. A right-sized questionnaire. The tier picks the size: Lite (25 questions) for Low, Core (60) for Medium, Full (114) for High and Critical. The questions are our own plain-English wording across 18 areas, from access control and encryption to breach notice and AI use. If the vendor already has a SOC 2 Type II report, an ISO/IEC 27001 certificate, a completed SIG, CAIQ or HECVAT, or a pen test letter, the questions those cover become optional — less work for them, faster answers for you.
  • 3. Send it and get it back. Download the questionnaire as a spreadsheet (CSV) with a ready-to-send cover email. The vendor fills in Yes, Partial, No or N/A, and you import their file — column order, semicolons and Excel's quirks are fine as long as the ID column is kept. You can also answer on the page during a call.
  • 4. Score and decide. Yes counts in full, Partial half, No and blank answers count as zero, and N/A is left out. Optional questions left blank are credited from the report you received — check that report for exceptions. Key questions answered No or Partial (or left blank) are red flags whatever the score. The inherent tier and the score combine into a residual risk and a suggested decision; you make the call and print a decision record.
  • 5. Keep on top of it. Every vendor is saved in this browser with its next review date (from the tier: every three years for Low, two for Medium, yearly for High and Critical). Export the dates to your calendar, download follow-ups as a task list for Microsoft Planner, To Do, Jira, Asana or Excel, and send High or Critical vendors to the Risk Register.

This is a practical way to run proportionate vendor due diligence — not legal advice or a formal audit. Your contracts, regulators and customers may require more.