Questionnaire for suppliers

1. General information on the supplier

Company name*

Address*

Number of employees*

Contact person for information security (name, position, contact)*

Industry*

What services or products do you supply to our company?*

2. Certifications and standards

Is your company certified to one of the following standards?

ISO/IEC 27001

BSI-Grundschutz (IT-Baseline according BSI-standard)

TISAX (Trusted Information Security Assessment Exchange)

Other (please specify)

If yes for 2.1, please indicate the year of the last certification and the certifier

ISO/IEC 27001

BSI-Grundschutz

TISAX

Other

If not certified, do you plan to obtain certification in the next 12 months?*

yes

If so, which standard?

Planned certification date

3. Information security management system (ISMS)

Does your company have a formal information security management system (ISMS)?*

yes

If yes, which framework is used (e.g. ISO 27001, BSI-Baseline)?

How often is the ISMS reviewed and audited internally and externally?

Internal: (e.g. annually, semi-annually)

External: (e.g. annually, every 2 years)

Does your company have an information security officer (CISO)?*

yes

If yes, please indicate the position and responsibilities:

Is there a data protection officer (DPO) in your company?*

yes

If yes, please indicate the position and responsibilities:

4. Risk management

Do you carry out regular risk assessments?*

yes

If yes, at what interval?

How are identified risks handled in your company?

Risk acceptance

Risk reduction

Risk transfer

Risk avoidance (explanation, which tools are used)

Further information:

Is there a documented incident response plan for security incidents?*

yes

If yes, when was this last updated?

5. Technical and organizational measures

Which of the following technical measures have been implemented in your company?

Firewalls

Encryption of data (at rest and in transit)

Access controls (physical and logical)

Anti-Malware-Software

Intrusion Detection/Prevention System

Regular security updates and patch management

Other:

How do you ensure that only authorized persons have access to confidential information?

Multi-factor authentication

Access restrictions

Role-based access control (RBAC)

How are security incidents reported and handled in your company?

Reporting channels and responsibilities:

6. Awareness and training

Are your employees regularly trained in information security?*

yes

If so, how often do the training courses take place?

Is there special training for employees in safety-critical positions?*

yes

If yes, please provide details:

7. Data protection

How do you ensure the protection of personal data in your company?

Measures and processes:

Is your company compliant with the General Data Protection Regulation (GDPR)?*

yes

If so, how is this ensured?

8. Supplier management and third parties

Do you have security requirements that you pass on to your own suppliers?*

yes

If yes, please specify:

How do you ensure that third parties who have access to sensitive information implement appropriate security measures?

Contractual clauses

Regular audits

Safety certificates

9. Conclusion

Is there any further information or documentation you would like to provide us with regarding your information security?