Security questionnaire template in Excel: what to use and where to get it
Franklin Lupichuk, founder of Rendro · Nov 5, 2026 · 4 min read
Send us your blank questionnaire. First 25 answers free in 48 hours.
What happens next: you email the blank file, we answer the first 25 questions from your public pages with a source for each, and send them back in your own file within 48 hours. Just your email and company name. No card.
People who search for a "security questionnaire template in Excel" usually mean one of two different things, and the right next step depends on which. Either you are the buyer and want a form to send to your vendors, or you are the vendor and have been sent one and want a head start on answering it. This guide covers both, and says plainly which free options are worth your time.
If you are answering a questionnaire: don't start from a template
If a customer has sent you a spreadsheet, fill in that spreadsheet. Their security team scores it, compares it with other vendors and often loads it into a tool. A questionnaire rebuilt in your own template, or answers pasted into a separate document, gets sent back. The only template you need is a way to prepare your answers, which is what the rest of this section is about.
What helps is a bank of answers you can adapt: the same topics (access control, encryption, incident response, vendors, business continuity, privacy) appear in almost every questionnaire. We publish 50 common security questions with example answers, and the same material is available as a free Excel file: the Rendro starter kit lists the 50 most common security questions with how to answer each. Enter your email and company and we send you the link. Use it as a reference to adapt, not something to paste. Replace every example with a fact about your own company, and never keep an answer for a control you don't have.
For the process around it, see how to answer a security questionnaire and filling out a security questionnaire in Excel, which covers dropdowns, merged cells and formulas.
If you are sending a questionnaire: free standards you can start from
Writing your own question list from nothing is slow, and vendors prefer a standard they have already answered. These are the commonly used starting points:
- **CAIQ (Cloud Security Alliance).** A questionnaire mapped to the Cloud Controls Matrix, free to download as a spreadsheet from the [CSA CAIQ page](https://cloudsecurityalliance.org/research/topics/caiq). Our CAIQ guide explains the versions.
- **VSAQ (Google).** An open-source questionnaire framework published at [github.com/google/vsaq](https://github.com/google/vsaq). It is a web-based tool rather than an Excel file, so check whether it suits how you collect answers. See the VSAQ explained.
- **VSA questionnaire (Vendor Security Alliance).** A free set aimed at software vendors: see the VSA guide.
- **SIG and SIG Lite (Shared Assessments).** Widely used by banks and insurers, but licensed, so you obtain it from the publisher rather than downloading a free copy. See the SIG Lite guide.
- **HECVAT.** Built for higher education. See the HECVAT guide.
If you build your own, organise the questions by topic and map them to a framework your reviewers already know, such as the [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework), so you can score answers consistently.
What a good custom template looks like
If a standard doesn't fit and you do write your own, a sheet that vendors can answer quickly and you can review quickly has these columns:
| Column | Why it is there |
|---|---|
| Question ID | Lets both sides refer to a row |
| Topic | Filter by access control, encryption, privacy and so on |
| Question | One idea per question; avoid "and/or" |
| Answer (dropdown: Yes / No / Partial / Not applicable) | Makes answers comparable and countable |
| Comment | Where the vendor explains in a sentence or two |
| Evidence | Name of the document that backs the answer |
| Reviewer notes | Your internal column; remove before sending |
Keep it short. A 300-question form for a low-risk vendor produces tired, copy-pasted answers. Ask only what you will use in your decision, and say how long vendors have to return it.
Mistakes when working from a template
- **Overwriting formulas or dropdowns.** Type only in the answer cells and use the allowed values.
- **Leaving example text in.** A starter answer that mentions a tool you don't use is worse than a blank.
- **Changing the structure.** Don't delete rows, merge your own cells or rename tabs; it breaks the buyer's checks.
- **Answering from memory.** Open the policy first and say what is written down. If you can't point to a source, treat the answer as a gap and word it honestly.
Where Rendro helps
Rendro drafts answers directly in the buyer's own Excel file, only from your own documents, shows the source for each answer, and marks anything it can't support as Needs review instead of guessing. Tabs, dropdowns, merged cells and formulas stay intact. You still review and approve every answer.
Got a questionnaire open right now? Send us the blank file and we'll fill in the first 25 questions free within 48 hours, so you can judge the quality before you pay: get the free 25-answer sample. Send only the blank questionnaire, never confidential documents. Not ready for that yet? Take the free starter kit first. To finish a whole questionnaire you can start the 14-day free trial (work email, no card).