What outcome does a security questionnaire help determine?

• A. It determines the vendor's marketing alignment.
• B. It assesses financial stability.
• C. It helps determine vendor controls and risk levels.
• D. It sets data retention periods.

Answer: (C)

Security questionnaires are used to assess a vendor's information security controls and risk posture. By collecting evidence on how the vendor protects data—such as access controls, encryption, incident response, data handling, governance, training, and third‑party sub‑processors—the questionnaire helps map those controls to your risk criteria. The outcome is a clear view of whether the vendor’s controls meet your requirements and what level of risk they pose to your organization. This enables you to decide if the vendor is acceptable, what additional mitigations or contractual controls are needed, or whether to seek alternatives. Other options—marketing alignment, financial stability, or data retention periods—aren’t the primary aim of a security questionnaire, which focuses on information security controls and risk level.