Describe the organization, vendor, system, or service. Makeform builds a structured questionnaire covering ownership, access, data, safeguards, incidents, resilience, and evidence.
Route assessment responses to Slack, Google Sheets, and Zapier.
Sample prompts for the builder
Choose a scenario, tailor the prompt, or send it to the Makeform builder.
Audience
Technology vendors handling company or customer data
Format
Sectioned questionnaire with evidence uploads
Prompt size
289 chars
Example questionnaire structure
Sectioned questionnaire with evidence uploads
Service, data types, and hosting locations
How is privileged access approved and reviewed?
Upload supporting control evidence
Has a material security incident occurred?
Control owner
Next review date
Suggested routing tags
Review required
Evidence missing
Follow-up complete
Ask for evidence and an owner beside each important control; yes alone lacks context.
Step 1
Scope
service, systems, data, and dependencies
Step 2
Question
controls, owners, dates, and evidence
Step 3
Review
gaps, context, likelihood, and impact
Step 4
Follow up
actions, owners, due dates, and reassessment
Assessment-ready answers
Connect answers to scope, evidence, ownership, and follow-up so reviewers can evaluate risk instead of counting yes answers.
Show data questions when information is processed, exposure questions for internet-facing systems, and supplier questions when third parties are involved.
Place an upload, link, test date, or explanation beside its control instead of maintaining a separate evidence list.
A no, partial, or unknown answer can open fields for the gap, current safeguards, owner, due date, and notes.
One structure, several reviews
Start with the audience and decision, then keep only relevant control areas.
Review service scope, information access, hosting, subcontractors, safeguards, and incident contacts.
Collect consistent answers, clarify ownership, and compare gaps across departments.
Route higher-exposure projects toward deeper architecture, access, logging, and data review.
Capture changes, refresh evidence, revisit actions, and record a new decision.
Questionnaire workflow
Generate focused questions, collect evidence, and tie decisions to owners and dates.
Name the respondent, system, information, review stage, and decision. Specific scope produces relevant questions.
Use your teams, risk scale, evidence expectations, and escalation paths. Add follow-ups for exceptions.
Share one link, require key fields, and notify the reviewer when responses need attention.
Capture notes, outcome, open risks, owners, and dates. Reassess after change or on your cadence.
Choose the right depth
Use intake for scope, assessment for controls, and reassessment for changes and unfinished work.
Field guide
Use these six sections as a practical starting point, then adjust the language and depth to the organization, supplier, system, and information in scope.
Scope & ownership
Define the system, purpose, owner, users, integrations, and dates before reviewers interpret control answers.
Information handling
Ask what information enters, where it is stored, how it moves, who receives it, and when it is removed.
Identity & access
Capture user approval, authentication, removal, and reviews. Ask separately about administrators and service accounts.
Protection & monitoring
Cover configuration, updates, vulnerabilities, safeguards, logging, and alert review. Request ownership and dated evidence.
Incidents & resilience
Ask who declares incidents, how contacts are notified, when exercises occurred, and how restoration is tested.
Risk & follow-up
For each gap, capture scope, current safeguards, likelihood, impact, treatment, owner, and date.
Related tools
Pair the assessment with risk intake, audit requests, vendor follow-up, awareness checks, and incident records.
Capture broader operational risks, impact, existing measures, owners, and treatment dates.
Open toolStandardize requests for review scope, timing, stakeholders, documents, and access.
Open toolCollect vendor policy, contract, operating, and documentation details for a separate review track.
Open toolCreate knowledge checks for staff awareness sessions and role-specific learning follow-up.
Open toolRecord incident findings, completed actions, remaining risks, owners, and closure review.
Open toolGive employees and partners a consistent way to report suspected security events and context.
Open toolFAQ
Practical answers for security, technology, procurement, and compliance teams designing an assessment.
It is a structured set of questions about an organization's, system's, or vendor's cybersecurity exposure and safeguards. It covers scope, data, access, protection, monitoring, incidents, resilience, evidence, gaps, and owners. Answers support reviewer judgment and verification.
Ask about scope, hosting, data flows, user and privileged access, vulnerabilities, updates, logging, incident communication, restoration tests, subcontractors, changes, and evidence. Add follow-ups for no, partial, unknown, or not-applicable answers.
Use the shortest set supporting the decision. Intake may establish only scope and exposure; a critical supplier may need controls and evidence. Branch for public access, sensitive information, administrators, or subcontractors.
Ask who owns the process, what it covers, when it last occurred, what evidence exists, and what exceptions remain. Offer implemented, partial, planned, not applicable, and unknown, then request context.
Request evidence that helps the review, such as a dated record, process excerpt, test summary, diagram, or redacted screenshot. Avoid unnecessary secrets and set handling rules for uploaded files.
Use a transparent scale for exposure, control status, likelihood, and impact. Treat automated scores as triage. Let reviewers document rationale, consider safeguards, adjust outcomes, and assign actions.
Yes. Makeform supports unlimited free forms and responses, so you can generate, edit, publish, and collect assessment responses without a form or response cap. The paid tier removes the Makeform badge.
Set a cadence based on criticality and reassess after material change. Triggers include new integrations, access, hosting, subcontractors, incidents, architecture work, overdue actions, or renewal. Ask what changed first.
Replace generic checklists with reviewable answers.
