Vendor survey

Questions to send an SPA vendor.

Ask what the service holds, where it lives, who can open it, which logs you can take with you, and which tasks stay yours. The blank file is the copy you send. The form below is a place to draft answers in the browser.

Download the blank questionnaire

Not legal advice. This is a plain-language reading aid for contractors and the providers who support them. It is not a CMMC assessment, not a FedRAMP determination, and not a substitute for 32 CFR Part 170, the contract, or advice from counsel. Templates and worksheet results are starters. Replace every example with your own facts.

Service identityLegal name of the company that would contract with the customer, and the product or service name.Is this software the customer runs, your cloud service, or a managed service on the customer’s systems? If more than one, describe each.What security function does this service perform for a customer’s environment?

Data the service holdsWhat data do you ingest, store, or transmit for the customer? List categories such as alerts, system logs, configuration, vulnerability findings, identity attributes, endpoint telemetry, file contents, message bodies, and screenshots.Can that data include CUI, including file contents, message content, or document text? Answer yes, no, or it depends, and explain.If you do not take CUI, do you store or process security protection data, such as configuration, logs, vulnerability status, or credentials that grant access to the customer environment?Can the customer configure the service so CUI is not ingested? If yes, how? If no, say so.

Where the data livesWhere is customer data stored, including backups and longer-term log storage? Name regions or facilities.Which subprocessors or hosting providers store or process that data, and what do they hold?Does customer data leave the United States? If it can, say when.How long do you retain customer data, and how does the customer request return or deletion?

Access controlWhich of your personnel can access customer data or the customer tenant? Say whether that access is standing or granted per request.Can the customer use its own identity provider for administrative access?How is privileged access approved, logged, and revoked?Can customer administrators be separated from your personnel?

Logging the customer can useWhich logs can the customer export, and in what form?Do those logs include content that may be CUI, or only security events?How long do you keep logs, and where are older logs stored?Can the customer send a copy of logs to a system the customer controls?

Shared responsibilityWhich security tasks do you perform, and which stay with the customer?What must the customer configure for the service to work as you describe it?Do you provide a customer responsibility matrix, or an equivalent split of duties? If yes, say how to obtain the current version.

Incidents and changesHow do you notify the customer of a security incident that affects the service or the customer’s data?What will you preserve if the customer has to investigate?How do you tell the customer about changes to data location, subprocessors, or administrative access?

Documents you can provideWill you provide a service description, a data-flow description, and the responsibility split so the customer can document the service in its system security plan? This asks for documents. It does not ask you to certify the customer.If the service stores, processes, or transmits CUI, identify any FedRAMP authorization, or any body of evidence you offer under the December 2023 DoD equivalency memorandum. If the service does not handle CUI, say that and do not attach an authorization claim.Name a contact for these questions.

Draft answers stay in this browser until you download them. This page does not send them to the site. To send a blank copy, use the file linked above.