Reactforce | Cybersecurity. Business. Resilience.

📋

Completion Instructions

Complete all fields in the Vendor Information section below.

For each question, select Yes, No, or N/A.

Use the Evidence / Comments field to support your response — especially where explanation is requested.

Attach supporting documentation where referenced (SOC 2, pen test, BCP attestation, etc.).

An authorized representative must complete and submit the Attestation at the end.

Return to your designated the Client contact securely.

🏢

Vendor Information

Legal Company Name * Required

DBA / Trade Name (if different)

Primary Business Address

Website

Date Completed *

Authorized Representative Name *

Title / Role

Phone Number

Email Address *

PII/PHI/CUI Contact / Engagement Reference

Nature of Services Provided to PII/PHI/CUI

Data Accessed / Processed

Member PII Financial Data Auth Credentials Internal PII/PHI/CUI Data None

Estimated Number of PII/PHI/CUI Records

Vendor Tier (PII/PHI/CUI Use Only)

Sub-processors / Fourth Parties Used?

Yes — listed in comments No

📂

1. Data Governance & Privacy

Q1–5

# Question	Response	Evidence / Comments

🌐

2. Data Location & Storage

Q6–9

# Question	Response	Evidence / Comments

👥

3. People & Access Controls

Q10–14

# Question	Response	Evidence / Comments

💻

4. Devices & Endpoint Security

Q15–19

# Question	Response	Evidence / Comments

🔒

5. Network Security

Q20–25

# Question	Response	Evidence / Comments

🛡️

6. DNS & DDoS Protection

Q26–27

# Question	Response	Evidence / Comments

🔍

7. Vulnerability & Patch Management

Q28–32

# Question	Response	Evidence / Comments

🛠️

8. Application Security

Q33–36

# Question	Response	Evidence / Comments

📊

9. Security Monitoring & SOC

Q37–40

# Question	Response	Evidence / Comments

🤝

10. Your Vendor Risk Management (Fourth-Party)

Q41–44

# Question	Response	Evidence / Comments

🚨

11. Incident Response

Q45–49

# Question	Response	Evidence / Comments

🏛️

12. Business Continuity & Disaster Recovery

Q50–54

# Question	Response	Evidence / Comments

📋

13. Assessments, Audits & Penetration Testing

Q55–58

# Question	Response	Evidence / Comments

✅

14. Compliance & Certifications

Q59–61

# Question	Response	Evidence / Comments

🏛️

15. Cybersecurity Governance

Q62–65

# Question	Response	Evidence / Comments

🔑

16. Authentication & Password Security

Q63–65

# Question	Response	Evidence / Comments

🚪

17. Access Control

# Question	Response	Evidence / Comments

🎓

18. Security Awareness & Training

# Question	Response	Evidence / Comments

🛡️

19. Data Security & Breach History

# Question	Response	Evidence / Comments

📁

20. Insurance

# Question	Response	Evidence / Comments

🤖

21. Artificial Intelligence (AI) Governance

# Question	Response	Evidence / Comments

🔔

22. Material Change Notification

# Question	Response	Evidence / Comments

Vendor Attestation & Signature

By signing below, the authorized representative of the vendor organization attests that the information provided in this questionnaire is accurate and complete to the best of their knowledge, and that the vendor organization will promptly notify the Client of any material changes to the information provided.

The information provided in this questionnaire is true, accurate, and complete to the best of my knowledge.
I am authorized to provide this information on behalf of my organization.
My organization will notify the Client within 24 hours of any confirmed or suspected incident affecting PII/PHI/CUI data.
My organization will notify the Client of material changes to this questionnaire's responses within 30 days of such change.

Authorized Representative Signature

Printed Name & Title

Company Name

Date

Reactforce — Third-Party Risk Management Program
Return completed form securely to your designated Reactforce contact. Version 2.0 · March 2026.