How to build a vendor security questionnaire for Canadian organizations

Many recent Canadian breaches started at a supplier: a managed service provider, a payroll platform, a file-transfer tool. Under PIPEDA, you remain accountable for personal information you hand to a third party for processing, and Quebec's Law 25 imposes specific duties when you outsource or send data outside the province. A vendor questionnaire is how you show you did your homework before signing, and it gives you leverage to negotiate fixes.

This guide builds a questionnaire in proportion to the risk, so low-risk suppliers get a short form and critical ones get a deep review.

Step 1: Tier your suppliers

The Canadian Centre for Cyber Security's Cyber supply chain: An approach to assessing risk (ITSAP.10.070) starts by rating the sensitivity of each product or service as low, medium or high, based on its function, the data it handles and its context. It says the effort you put into assessing the supplier should depend on that rating. A simple scheme:

• High: administrative access to your network or identity systems, or custody of sensitive personal information (MSPs, cloud hosting, payroll, HR, health or financial data).
• Medium: limited personal information or integration with business systems.
• Low: no data access and no network connection.

Step 2: Ask about ownership, jurisdiction and data location

The Cyber Centre asks organizations to weigh who owns and controls a supplier, the legal framework it operates under and whether it could be compelled to act against your interests. Questions:

1. Who owns the company, and where is it headquartered?
2. In which countries will our data be stored, processed or accessed, including by support staff and subcontractors?
3. Which subcontractors (sub-processors) will handle our data? How will you notify us of changes?
4. Can you keep data in Canada if we require it?

Why it matters: the Office of the Privacy Commissioner of Canada says organizations transferring data for processing must tell people their information may be processed in another country and be accessible to its courts and authorities. Under Law 25, sending personal information outside Quebec requires a privacy impact assessment first, and the transfer must be backed by a written agreement.

Step 3: Ask about security practices

1. Which security standards or certifications do you hold (for example, ISO/IEC 27001 or a SOC 2 Type II report)? Provide the current certificate or report.
2. Do you require multi-factor authentication for all staff, and phishing-resistant MFA for administrators?
3. How do you encrypt our data in transit and at rest? Who manages the keys?
4. How fast do you patch critical and actively exploited vulnerabilities?
5. How do you control and log staff access to customer environments? Can we receive those logs?
6. For MSPs: how do you secure remote-management tools, and are your accounts in our tenant separate per technician?
7. Do you run vulnerability scans and annual penetration tests? Share a summary.
8. How are backups protected, and when did you last test a restore?
9. How do you handle vulnerability reports from outside researchers?

Step 4: Ask about incidents and continuity

1. Have you had a security incident affecting customer data in the past three years? What changed afterwards?
2. How quickly will you notify us of an incident affecting our data, and through whom? Ask for a specific number of hours in the contract.
3. Will you give us the information we need to meet our own reporting duties under PIPEDA, Law 25 or provincial law?
4. Do you have a tested business continuity and disaster recovery plan? What are your recovery time objectives?
5. Do you carry cyber insurance?

Step 5: Ask about privacy and the end of the contract

1. Will you use our data for any purpose other than providing the service, including training AI models?
2. How will you return our data at the end of the contract, in what format, and how will you destroy remaining copies? Will you certify destruction?
3. Can you support requests from individuals to access, correct or port their data?

Step 6: Put the answers into the contract

Questionnaire answers are only promises until they are in writing. Law 25 requires a written agreement when you give a service provider personal information, and the OPC's cross-border guidance says contracts are the main way to protect data held by a processor, including a right to audit. Include:

• specific security obligations and breach notification deadlines;
• limits on use, subcontracting and data location;
• audit rights or access to independent audit reports;
• return and destruction of data on termination;
• a duty to help you meet regulatory reporting obligations.

Federally regulated financial institutions must also meet OSFI's Guideline B-10, Third-Party Risk Management, which expects risk assessments, due diligence, incident reporting by third parties, audit rights, and exit plans for critical arrangements. Its annexes are a useful checklist for other sectors too.

Keep the questionnaire usable

Long questionnaires get copied answers. Keep the low-tier form to a handful of yes-or-no questions, and accept a current SOC 2 Type II report or ISO/IEC 27001 certificate in place of questions it already covers, after checking that its scope includes the service you are buying. Ask for evidence on the few controls that matter most to you, such as MFA and breach notification, rather than for every policy document the supplier owns.

Step 7: Score, decide and review

1. Score answers as acceptable, needs remediation or unacceptable. The Cyber Centre's final step is a decision: accept the risk, apply stronger mitigations, or pick another supplier.
2. Record the decision and who approved it.
3. Review high-tier suppliers every year and at renewal, and whenever they report an incident, change ownership or change subcontractors.

Sources

• Canadian Centre for Cyber Security: Cyber supply chain, an approach to assessing risk (ITSAP.10.070)
• OPC: Guidelines for processing personal data across borders
• OSFI: Guideline B-10, Third-Party Risk Management
• Commission d'accès à l'information: Réaliser une évaluation des facteurs relatifs à la vie privée