[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Third-Party Risk Management](/category/third-party-risk-management) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is the Vendor Security Alliance Questionnaire (VSAQ)?](/blog/vendor-security-alliance-questionnaire) Publish date July 8, 2025 {x} minute read # What is the Vendor Security Alliance Questionnaire (VSAQ)? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/cyber-risk-guide-to-vendor-questionnaires) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook Cyber Risk Guide to Vendor Questionnaires Free resource ### Cyber Risk Guide to Vendor Questionnaires [Download now](/resources/cyber-risk-guide-to-vendor-questionnaires) The [Vendor Security Alliance Questionnaire (VSAQ)](https://www.vendorsecurityalliance.org/)was created by a coalition of companies committed to improving Internet security. It is one of the most well-known, highly respected security questionnaires, alongside: * [The Cloud Security Alliance (CSA) Consensus Assessments Initiative Questionnaire (CAIQ)](https://www.clearscope.io/blog/caiq) * [CIS Critical Security Controls](https://www.upguard.com/blog/cis-controls) * [NIST SP 800-171](https://www.upguard.com/blog/nist-sp-800-171) * Standardized Information Gathering Questionnaire ([SIG / SIG-Lite](https://sharedassessments.org/sig/)) * [ISO 27001](https://www.upguard.com/blog/what-is-iso-27001) The VSA questionnaire is free to use and accessible on the VSA website.   [Learn how UpGuard streamlines the security questionnaire process >](https://www.upguard.com/product/security-questionnaires) ## Who Created the Vendor Security Alliance (VSA)? The Vendor Security Alliance (VSA) was formed by Airbnb, Atlassian, Docker, Dropbox, and Uber to streamline vendor security compliance and due diligence, allowing its members to leverage the VSA network of third-party auditors to carry out [vendor risk assessments](https://www.upguard.com/blog/third-party-risk-assessment-best-practices). This enables [vendors](https://www.upguard.com/blog/third-party-vendor) to assess other vendors faster and at a lower cost than before. Alongside its founding members, the VSA includes companies like Adobe, Coinbase, TaskUs, and Replicated. ## Why Was the VSA Questionnaire Created? The VSA questionnaire was created to help businesses address growing cybersecurity risks across third-party cloud services and SaaS providers. When used during due diligence, the VSAQ secures the vendor vetting process, allowing organizations to identify the potential impact a prospect will have on their security posture. In the past, companies had no standardized way to assess the security risks of their peers and third-party vendors. Now, thanks to questionnaires mapping to standards such as VASQ and PCI DSS, organizations can understand the [information security policies](https://www.upguard.com/blog/information-security-policy) of prospective partners and select vendors based on informed cybersecurity decisions. With innovative features like [questionnaire automation technology](https://www.upguard.com/product/security-questionnaires), significant advancements have been added to [Vendor Risk Management products](https://www.upguard.com/product/vendorrisk). Today, organizations can have complete visibility and control of their third-party risk landscape, reducing [business continuity distruptions](https://www.upguard.com/blog/business-continuity-plan) caused by vendor security hiccups. ## What are the Types of VSA Questionnaires? The VSA issues two free questionnaires which are updated annually: * **VSA-Full: **This is the classic VSA questionnaire that focuses deeply on vendor security and is used by thousands of companies globally. * **VSA-Core: **This questionnaire is comprised of the most critical vendor assessment in addition to privacy. The privacy section covers both US data breach notification requirements, [the California Consumer Privacy Act (CCPA)](https://www.upguard.com/blog/what-is-the-ccpa), and [the General Data Protection Regulation (GDPR)](https://gdpr.eu/). ### VSA-Full The VSA-Full was first published in 2016 and was designed to help companies improve their vendor risk management program by streamlining vendor security assessments. The VSA questionnaire contains eight different sections including: 1. Service Overview 2. Data Protection & [Access Control](https://www.clearscope.io/blog/access-control) 3. Policies & Standards 4. Proactive Security 5. Reactive Security 6. Software Supply Chain 7. Customer Facing Application Security 8. Compliance ### VSA-Core The VSA-Core questionnaire focuses on security and privacy principles and practices. From a security perspective, it does not go into the same depth as the VSA-Full questionnaire but it does add the Privacy section that covers the core principled of USA data breach laws, the California Consumer Privacy Act, and GDPR. The VSA-Core questionnaire should be used when companies wish to ensure the vendor has well-designed security and privacy operations, whereas the VSA-Full focuses solely on security. [Learn how to choose security questionnaire automation software >](https://www.upguard.com/blog/choosing-security-questionnaire-automation-software) ## How is the VSA Questionnaire Different From Other Vendor Assessment Questionnaires? Unlike other questionnaires, the VSA assessment process was created with the vendor in mind. Its focus is to eliminate irrelevant questions, reducing the time it takes for InfoSec and security teams to complete the questionnaire. Security experts know that any vendor supplying a product or service can introduce risk, especially if they have access to sensitive data without appropriate controls in place. The issue is that getting vendors to complete security questionnaires can be laborious, time-intensive and expensive. This is why the VSA urges companies approach third-party risk management as: * **Data-risk based: **Not all vendors should be held to the same standard, the risk is proportionate to the sensitivity of the data they are accessing (and its volume). This means the security controls vendors have in place must be proportionate to their risk * **Integrated security: **Great security is not achieved by purchasing a product, it's achieved by taking a [defense in depth](https://www.upguard.com/blog/defense-in-depth) approach that starts with how the product is designed, tested, patched and maintained, as well as what steps have been taken to minimize the chance of a data breach, and what happens after a security incident ([incident response planning](https://www.upguard.com/blog/incident-response-plan) and disaster recovery) * **Service-oriented: **Many companies offer multiple products and services. Rather than auditing the company, the VSA assessment process focuses on the product or service being delivered. This means vendors should fill the questionnaire out for each specific product or service that is being evaluated.   [Read our guide on the top security questionnaires >](https://www.clearscope.io/blog/top-vendor-assessment-questionnaires) ## What Type of Organization Should Use the VSA Questionnaire? While the VSA questionnaire was originally created for the VSA's members, it is free to use for any security team as a means to assess the data security standards of vendors. Common industries include financial services, technology, healthcare, government, and higher education. ## Why You Should Consider Using Security Ratings With the VSA Questionnaire [Security ratings](https://www.upguard.com/blog/what-are-security-ratings) provide risk management and security teams with the ability to continuously monitor the [security posture](https://www.upguard.com/blog/security-posture) of their vendors. The benefit of security ratings alongside security questionnaires is they are automatically generated, updated frequently, and they provide a common language for technical and non-technical stakeholders. The key thing to understand is that security ratings fill the large gap left from traditional risk assessment techniques like security questionnaires. Sending questionnaires to every third-party requires a lot of commitment, time, and frankly isn't always accurate. Security ratings can complement and provide assurance of the results reported in security questionnaires because they are externally verifiable, always up-to-date, and provided by an independent organization. > According to [Gartner](https://www.gartner.com/en/documents/3884271/innovation-insight-for-security-rating-services), *cybersecurity ratings will become as important as credit ratings when assessing the risk of existing and new business relationships…these services will become a precondition for business relationships and part of the standard of due care for providers and procurers of services.* [Read more about why security ratings are important](https://www.upguard.com/blog/security-ratings-important) > [UpGuard](https://www.clearscope.io/) is one of the most popular security rating providers. We generate our ratings through proprietary algorithms that take in and analyze trusted commercial and open-source security risk feeds, and non-intrusive data collection methods to quantitatively evaluate the security practices of service providers. We base our ratings on the analysis of 70+ vectors, including: * [Susceptibility to man-in-the-middle attacks](https://www.upguard.com/blog/man-in-the-middle-attack) * [Insecure SSL/TLS certificates](https://www.upguard.com/blog/ssl-certificate) * [SPF, DKIM and DMARC settings](https://www.upguard.com/blog/email-security) * [HTTP Strict Transport Security (HSTS)](https://www.upguard.com/blog/hsts) * [Email spoofing and phishing risk](https://www.upguard.com/blog/email-spoofing) * [Vulnerabilities](https://www.upguard.com/blog/vulnerability) * [Malware susceptibility](https://www.upguard.com/blog/types-of-malware) * Unnecessary open administration, database, app, email and file-sharing ports * Exposure to known [data breaches](https://www.upguard.com/blog/data-breach) and [data leaks](https://www.upguard.com/blog/data-leak) * Vulnerable software * HTTP accessibility * Secure cookie configuration * Results of[ vendor risk assessment questionnaires](https://www.upguard.com/blog/vendor-risk-assessment-questionnaire-template) If you’re curious about other security rating services, see our guide on[ SecurityScorecard vs BitSight here](https://www.upguard.com/compare/bitsight-vs-securityscorecard). Watch the video below to learn how UpGuard streamlines risk assessment workflows. eBook Cyber Risk Guide to Vendor Questionnaires Free resource ### Cyber Risk Guide to Vendor Questionnaires [Download now](/resources/cyber-risk-guide-to-vendor-questionnaires) ## Related posts Learn more about the latest issues in cybersecurity. Third-Party Risk Management #### [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape) UpGuard has been named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Services 2026 Vendor Assessment. Find out why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 18, 2026 Third-Party Risk Management #### [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm) We researched four AI evidence-parsing tools against four criteria that security teams often overlook. None nailed all four. [](/team/cassy-van-eeden) [Cassy van Eeden](#) September 29, 2026 Third-Party Risk Management #### [The Vendor Assurance Confidence Gap: Why It’s Widest With Your Most Critical Vendors](/blog/vendor-assurance-confidence-gap) Vendor assurance efforts are rising while confidence in them is falling. This gap is widest with the vendors that matter most. Here’s why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) August 25, 2026 Third-Party Risk Management #### [Higher Education TPRM in 2026: New Research Maps the Vendor Visibility Gap](/blog/higher-education-tprm-2026) Explore UpGuard’s latest research into higher education third-party risk, including supplier concentration and systemic vendor exposure. [](/team/cassy-van-eeden) [Cassy van Eeden](#) August 10, 2026 Third-Party Risk Management #### [Ongoing TPRM Success: Continuous Security Monitoring with AI](/blog/continuous-security-monitoring-with-ai) Is manual work weighing down your security team and limiting your ability to scale? Learn how UpGuard and its AI features can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) September 29, 2026 Third-Party Risk Management #### [Report Writing Solved: Generating Actionable Assessment Reports](/blog/report-writing-solved) Is manual report writing slowing down your security team? Learn how UpGuard’s AI can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) April 2, 2025 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)