The one-page vendor risk questionnaire small businesses actually send

Enterprise SIGs die in the inbox. Small businesses still need to know what a vendor touches, who can get in, and who owns the follow-up — before the next SaaS signup, not after the breach questionnaire lands.

Scarlet Risk is the foundational risk layer for SMB operators. This piece is a practical one-pager you can send and reuse. Not a theater binder. Not a cheaper-than-Vanta pitch. Protection is the point; certification is a byproduct when it matters.

Why SIGs fail SMBs

A 200-question SIG assumes a third-party risk team, a shared drive of evidence, and time nobody has. Founders and MSPs get a form, stall, and call it “vendor management.” Diligence without answers is cosplay.

What works instead: a short page with labels operators understand — Confirmed / Partial / Planned / Gap / Client-owned — and a clear escalate-to-SOC-2 rule when the vendor holds crown jewels (customer PII, production access, payment data, regulated workloads).

The 12-question spine

Use these as the spine. Adapt language; keep the intent.

1. What product/service do you provide us, and what business process depends on it?
2. What categories of our data can you access or store (none / metadata / customer / regulated)?
3. Where is that data processed and stored (regions / subprocessors you rely on)?
4. How do you authenticate admin access (SSO / MFA / password-only)?
5. How do you provision and revoke our users’ access — and within what SLA?
6. Do you encrypt data in transit and at rest? Where is that stated?
7. How do you notify us of a security incident that may affect our data (channel + timeline)?
8. When was your last independent security assessment (SOC 2 / ISO / pen test summary) — and can you share the cover letter or bridge letter?
9. Who is our named security / privacy contact on your side?
10. Which of your critical subprocessors touch our data?
11. What is your backup / recovery objective that matters to our uptime?
12. What happens to our data at contract end (return / delete / certify)?

Score each: Confirmed (evidence attached), Partial, Planned (date), Gap, or Client-owned (we hold the control).

Escalate-to-SOC-2 rule

If the vendor stores or can access customer or regulated data and you cannot get Confirmed answers on access, MFA, incident notice, and data disposition, escalate: require a current SOC 2 (or equivalent) package, or do not expand scope. Automation platforms (Secureframe, Scrut, Sprinto) help vendors produce evidence; your job is still the living diligence page — foundation first.

MSP reuse

MSPs: keep one master questionnaire. Per client, swap answers and evidence links — do not rewrite from zero. Same labels across the book. Put screenshots next to every “yes” insurers or buyers will ask about.

20-minute honesty pass

1. Name the five vendors that would hurt most if they failed tomorrow.
2. Send the one-pager (or fill what you already know).
3. Attach evidence or mark Gap.
4. Date the page. Assign one human owner.

Free Risk Snapshot (through Oct 31)

If you want a one-page view of where vendor and related risk may be building up — plus three practical next moves — claim a Free Risk Snapshot at https://scarletrisk.com/risk-snapshot. Through October 31 only. About three minutes. No sales call required. Optional short follow-up is a clarity pass, not a free consulting hour.

Want a second set of eyes on your vendor list once it’s filled in? Grab a short call with Pete: https://calendly.com/pete-scarletrisk/30min. No deck, no pressure.