# Vendor due-diligence questionnaire — Security Protection Asset

STARTER QUESTIONNAIRE. Edit it before you send it. Not legal advice. Not an assessment. Not a request that the vendor certify the customer. Use it to learn whether a security tool or managed security service handles CUI, handles security protection data, or both, and to record shared responsibility.

Leave the answer lines blank for the vendor, or draft answers before you send the file.

Customer: [name]
Service this questionnaire is about: [name]
Date sent: [date]

## Service identity

**Legal name of the company that would contract with the customer, and the product or service name.**

_Answer:_

**Is this software the customer runs, your cloud service, or a managed service on the customer’s systems? If more than one, describe each.**

_Answer:_

**What security function does this service perform for a customer’s environment?**

_Answer:_

## Data the service holds

**What data do you ingest, store, or transmit for the customer? List categories such as alerts, system logs, configuration, vulnerability findings, identity attributes, endpoint telemetry, file contents, message bodies, and screenshots.**

_Answer:_

**Can that data include CUI, including file contents, message content, or document text? Answer yes, no, or it depends, and explain.**

_Answer:_

**If you do not take CUI, do you store or process security protection data, such as configuration, logs, vulnerability status, or credentials that grant access to the customer environment?**

_Answer:_

**Can the customer configure the service so CUI is not ingested? If yes, how? If no, say so.**

_Answer:_

## Where the data lives

**Where is customer data stored, including backups and longer-term log storage? Name regions or facilities.**

_Answer:_

**Which subprocessors or hosting providers store or process that data, and what do they hold?**

_Answer:_

**Does customer data leave the United States? If it can, say when.**

_Answer:_

**How long do you retain customer data, and how does the customer request return or deletion?**

_Answer:_

## Access control

**Which of your personnel can access customer data or the customer tenant? Say whether that access is standing or granted per request.**

_Answer:_

**Can the customer use its own identity provider for administrative access?**

_Answer:_

**How is privileged access approved, logged, and revoked?**

_Answer:_

**Can customer administrators be separated from your personnel?**

_Answer:_

## Logging the customer can use

**Which logs can the customer export, and in what form?**

_Answer:_

**Do those logs include content that may be CUI, or only security events?**

_Answer:_

**How long do you keep logs, and where are older logs stored?**

_Answer:_

**Can the customer send a copy of logs to a system the customer controls?**

_Answer:_

## Shared responsibility

**Which security tasks do you perform, and which stay with the customer?**

_Answer:_

**What must the customer configure for the service to work as you describe it?**

_Answer:_

**Do you provide a customer responsibility matrix, or an equivalent split of duties? If yes, say how to obtain the current version.**

_Answer:_

## Incidents and changes

**How do you notify the customer of a security incident that affects the service or the customer’s data?**

_Answer:_

**What will you preserve if the customer has to investigate?**

_Answer:_

**How do you tell the customer about changes to data location, subprocessors, or administrative access?**

_Answer:_

## Documents you can provide

**Will you provide a service description, a data-flow description, and the responsibility split so the customer can document the service in its system security plan? This asks for documents. It does not ask you to certify the customer.**

_Answer:_

**If the service stores, processes, or transmits CUI, identify any FedRAMP authorization, or any body of evidence you offer under the December 2023 DoD equivalency memorandum. If the service does not handle CUI, say that and do not attach an authorization claim.**

_Answer:_

**Name a contact for these questions.**

_Answer:_