Vendor questionnaire templates

A questionnaire template is the set of questions you put to a supplier: sections, questions, answer types and guidance. It collects information and does not compute a rating. The assessor reads the answers and rates the vendor. Because the two are separate, a questionnaire can be long or short without changing the rating.

Templates live under Vendors → Templates, and an assessment uses one by attaching it. Not to be confused with the Questionnaires entry under Security, which holds the questionnaires your own customers send you.

Create a template

1. Open Vendors → Templates and choose Add questionnaire. The menu offers a Blank questionnaire and the system templates, with those matching your adopted frameworks listed first under For your frameworks and the rest under All templates.
2. Pick one. A system template is copied into a custom template of your own, with its sections and questions, and opens in the builder.

The system templates are the four VSAQ questionnaires (Infrastructure Security, Web Application Security, Security & Privacy Programs, Physical & Datacenter Security), CAIQ v4.0 and v4.1, Supplier quality (certifications, nonconformities, change notification and traceability, for ISO 9001 clause 8.4) and AI supplier (for a supplier of an AI system or model, ISO/IEC 42001 A.10.3).

Build the questionnaire

The Builder tab edits the whole structure in place and saves it in one go with Save structure; until then the page says Unsaved changes. The preview beside the editor renders what the vendor will see.

Add section opens a section with a title and a description. Add question adds a row to the section with the question text, a Response type, whether it is Required, the Options for a choice question (separated by ;), the Guidance shown to the vendor, and Show only when, a condition on earlier answers. Rows move with Move up and Move down; a section can be duplicated or removed.

A saved change reaches assessments started afterwards. A running assessment keeps the structure it was given when the questionnaire was attached.

Write it as text

Switch the builder to Text to write or paste the questionnaire as plain lines. It is the quickest way to bring in a long list, or one an AI assistant drafted for you. A line starting with # opens a section; a line starting with > under it is the section's description; every other line is one question:

# Security program
> How you run information security.
Do you have an ISMS? | yes_no_na | required
Certified against? | multi | optional | ISO 27001; SOC 2
Your incident process? | text | required | | Name the escalation
Attach your latest pentest | file | required

The parts of a question line are Question | type | required | Option A; Option B | guidance. Only the question is mandatory. The type tokens are yes_no_na, single, multi, text, file and info. An unknown type keeps the type of the row that was at the same position before, or falls back to yes/no.

Existing questions keep their identity by position. So you can retype a label or add a row at the end without breaking the conditions and running assessments that refer to other rows. Moving a row to another section in text mode gives it a new identity.

Show a question only when

A condition in Show only when names option ids and combines them with &&, ||, ! and parentheses; the question is shown while the condition holds. An id in a condition may contain only letters, digits and underscores and may not start with a digit, as the option ids of the system templates do (see them in the exported JSON). Options added in the builder get ids with hyphens, which a condition cannot name, and a condition that cannot be read is ignored: the question is always shown.

Export and import as JSON

A template's row menu offers Export, which downloads its structure as a JSON file. Import on the list reads such a file and creates a new custom template from it, with a slug derived from the name in the file. Use it to move a template between organizations or to take an editable copy of a centralized one. Export all exports the templates currently listed.

{
  "schemaVersion": 1,
  "name": "Supplier security",
  "description": null,
  "sections": [
    {
      "name": "Security program",
      "description": "How you run information security.",
      "order": 0,
      "questions": [
        {
          "text": "Do you have an ISMS?",
          "guidance": null,
          "responseType": "YES_NO_NA",
          "options": [],
          "required": true,
          "conditionalExpression": null,
          "order": 0
        }
      ]
    }
  ]
}

The response types in the file are YES_NO_NA, SINGLE_SELECT, MULTI_SELECT, TEXT, FILE and INFO. An option is an object with optionId, value and label.

The browser checks the whole file before anything is sent. If a check fails, nothing is imported:

• A file that is not JSON shows The selected file is not valid JSON.
• A file with the wrong shape shows The file does not match the questionnaire import format. Examples: an unknown responseType, a schemaVersion other than 1, an empty name, a section or question without an integer order, or an option without optionId, value or label.

Unknown extra keys are dropped. A conditionalExpression is stored without being checked.

Centralized and custom templates

Two kinds appear in the list. A centralized template is provided by devguard and read-only; you attach it as it is. A custom template belongs to your organization and is fully editable. A custom template with the same slug as a centralized one replaces it while the custom one is active. This applies in the list, in the attach picker, in search and at the template's address. Archive the custom one, and the centralized one is back. To get an editable copy of a centralized template, export it and import the file. The copy's slug comes from the name in the file, so it replaces the original only if the slugs match.

Reference

The template list

The list searches by name, filters by Type (centralized or custom) and Updated at, and shows archived templates behind Archived. The row menu holds Export and, for a custom template, edit (name and description), archive, restore and delete; rows can be selected for a bulk delete. A template's detail page has the Builder, a Usage tab listing the assessments it is attached to, Comments and History.

Permissions

Owners and admins create and edit custom templates; members and auditors read them. Centralized templates are read-only for everyone.

API

The template is in the public API, documented in the API reference. Its sections and questions come back with GET, but building them (sections, questions, the text structure, JSON import, copying a system template) is done in the app only.