Security Questionnaires Should Not Decide Vendor Trust

Summary

The article argues that self-reported security questionnaires can be stale and weak evidence. It recommends risk-based vendor reviews grounded in observable security indicators, independent reports and current evidence supporting contractual commitments.

Key points

• The author argues that questionnaires remain central to vendor due diligence despite being self-reported and potentially outdated.
• Verizon’s 2025 Data Breach Investigations Report found that the share of breaches involving a third party rose from 15% to 30%; IBM’s 2025 report estimated third-party and supply-chain compromises at roughly $4.9 million per incident.
• The article cites an October 2025 NYDFS industry letter calling for upfront vendor vetting, risk-based reassessment and independent audit reports.
• For vendor reviews, it recommends examining externally observable infrastructure, breach history and exposed credentials, then focusing deeper effort on vendors with significant data or access.
• It advises vendors to maintain current evidence of contractual security commitments and provide it on demand rather than repeatedly retyping questionnaire answers.
• Target was PCI DSS-certified in September 2013 and disclosed a breach involving 40 million payment cards that December; the article uses this to illustrate that certification is not proof of ongoing security.