A 30-minute vendor security review using public evidence

Most vendor security reviews start with a questionnaire and end six weeks later. The public record answers a large share of the questions in half an hour, and it tells you which questions are worth asking at all. This is the order CertReports was built around: registries first, because a third party publishes them with a date; vendor statements second, because they are at least dated; questionnaires last, because they are neither. The numbers below explain why the order matters.

84%

of TPRM programmes use security questionnaires

Secureframe, third-party risk statistics 2026

37.3

assessment requests the average vendor answers each month

Up from 29.5 the year before

30%

of breaches involved a third party in the 2025 DBIR

Verizon, up from about 15 percent

Why questionnaires are slow and public evidence is not

A questionnaire is a conversation. It takes the vendor 10 to 40 hours to answer by hand, two to four weeks to turn around, and up to three quarters of vendors either do not answer or answer late. Meanwhile the FedRAMP Marketplace, the DPF participant list, the Visa registry and the CSA STAR registry publish the status of thousands of vendors every day with no request at all, and trust centres publish the report type, the certificate edition and the DPA. A review that starts with those sources spends its questionnaire budget only on what is genuinely unknown.

Security questionnaires are the most popular method of assessing third-party risk, with 84% of respondents using them.

The percentages are the CertReports working estimate of how much of each questionnaire section can be answered from public, dated sources. They are a planning aid, not a measurement of any vendor.

The 30 minutes

1. 1

   Minutes 0 to 5: identity and scope

   Confirm the legal entity, the product and the domain. Open the vendor’s CertReports page from search: the header shows the category, the trust centre and the security page if they exist.
2. 2

   Minutes 5 to 12: registry-verified rows

   FedRAMP, DPF, PCI DSS and CSA STAR rows come from registries the index mirrors nightly. Each is dated and links to the registry record. These need no follow-up beyond scope matching.

3. 3

   Minutes 12 to 20: vendor-stated rows

   SOC 2 type and period, ISO 27001 edition and scope, HIPAA BAA offer, Cyber Essentials. Each links to the snapshot of the page that stated it. Note the ones older than a year; those become your first questions.

4. 4

   Minutes 20 to 25: legal artefacts

   DPA with SCCs, subprocessor list, AI policy, security.txt. Missing artefacts are a signal in themselves; a vendor with no public subprocessor list will struggle with your questionnaire.

5. 5

   Minutes 25 to 30: compare and decide what to ask

   Put the shortlist side by side on Compare and export the table with sources. The empty cells and the stale dates are your questionnaire; everything else is already answered.

The checklist, by framework

Questions worth asking sales

Sizing the questionnaire you still need

The research on questionnaire design is consistent: shorter is answered, longer is not. Programmes whose questionnaires cover 12 to 15 core domains keep vendor completion under 20 hours; programmes that average more than 300 questions see 67 percent higher non-completion and lower risk detection. Fifty-seven percent of programmes use a custom questionnaire and 18 percent use an industry standard such as SIG, which is why vendors answering 37 requests a month cannot reuse their work. Pre-filling from public evidence is the cheapest way to cut the count.

What a public review cannot tell you

• Whether the SOC 2 report contains exceptions on the controls you care about. Only the report says that.
• Whether the ISO scope covers the specific team and system that handles your data, unless the scope statement is published.
• Anything about penetration test results, which vendors almost never publish in detail.
• Whether the vendor’s contract will accept your security addendum.
• Whether the controls actually operate today, as opposed to during the last audit period.

Doing it for a list

For a vendor inventory rather than a single review, paste the list into the bulk check: twenty vendors free, five hundred on Buyer Pro with CSV export. Each cell is a dated state with a link to its evidence, and the table is the first draft of your third-party register.