Thirty-four questions to send a software vendor, an online form that sends nothing, and an open licence.
One questionnaire, in four formats
Before a terminal connects a new piece of software, its team checks the vendor. The questions are much the same from one port to another, because they come from the same public texts: the IMO guidelines on maritime cyber risk management (Rev.4, 28 May 2026), NIST SP 800-161, ENISA's good practices for supply chain cybersecurity, CISA's Secure by Demand guides and Articles 21 and 23 of NIS2. This questionnaire puts them in one file you can send, fill in and reuse.
One answer scale
How a terminal sends it
3. Read family by family
How a vendor answers
3. Export and send the file yourself
Fill it in online: nothing leaves your browser
Network calls blocked
JSON, CSV or paper
The 34 questions, family by family
Click a family to read its questions and their ids.
- ACC-01 Who in your company can reach our systems or our data, by role, and how many people is that?
- ACC-02 How do they connect (our VPN, a jump host, your own remote tool), and can we approve or cut each session?
- ACC-03 Is multi-factor authentication required for every person, including administrators and support staff?
- ACC-04 Are accounts named and personal, with no shared or default passwords?
- ACC-05 How fast is access removed when someone leaves your team, and how often do you review the list with us?
What to prepare and a model answer for this family: vendor cyber onboarding grid.
Sources: CISA and partner agencies, Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products (2025-01-13) · CISA, Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem (2024-08) · IMO, Guidelines on maritime cyber risk management, MSC-FAL.1/Circ.3/Rev.4 (2026-05-28)
- DAT-01 What data of ours do you store or process, and which of it is personal data?
- DAT-02 In which countries is it hosted, and by which hosting provider?
- DAT-03 Is it encrypted in transit and at rest, and who holds the keys?
- DAT-04 How is our data kept apart from your other customers' data?
- DAT-05 How long do you keep each kind of data, and can we change that?
What to prepare and a model answer for this family: vendor cyber onboarding grid.
Sources: ENISA, Good Practices for Supply Chain Cybersecurity (2023-06-13) · NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (2022-05 (updated 2024-11-01)) · IMO, Guidelines on maritime cyber risk management, MSC-FAL.1/Circ.3/Rev.4 (2026-05-28)
- LOG-01 What do you log (logins, administrator actions, changes of settings, API calls, data exports)?
- LOG-02 How long do you keep the logs, and are they protected against change?
- LOG-03 Can we receive the logs in our own monitoring tool (SIEM), in a standard format, at no extra cost?
- LOG-04 Are the clocks of your systems synchronised, so that times match ours?
What to prepare and a model answer for this family: vendor cyber onboarding grid.
Sources: CISA, Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem (2024-08) · CISA and partner agencies, Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products (2025-01-13) · IMO, Guidelines on maritime cyber risk management, MSC-FAL.1/Circ.3/Rev.4 (2026-05-28)
- BAK-01 How often is our data backed up, and where are the backups kept?
- BAK-02 Are backups separated from the production systems, so that one attack cannot reach both?
- BAK-03 When did you last restore from a backup as a test, and what was the result?
- BAK-04 How long does it take to restore the service, and how much data can be lost at most?
What to prepare and a model answer for this family: vendor cyber onboarding grid.
Sources: IMO, Guidelines on maritime cyber risk management, MSC-FAL.1/Circ.3/Rev.4 (2026-05-28) · ENISA, Good Practices for Supply Chain Cybersecurity (2023-06-13)
- INC-01 How and how fast will you tell us about an incident that affects our data or our service?
- INC-02 Who is our contact during an incident, and can we reach them at any hour?
- INC-03 What will your first notice contain, and how will you keep us updated?
- INC-04 Will you help us with our own notifications to the authorities, and share what you learned afterwards?
What to prepare and a model answer for this family: vendor cyber onboarding grid.
Sources: Directive (EU) 2022/2555 (NIS2), Articles 21 and 23 (2022-12-14) · IMO, Guidelines on maritime cyber risk management, MSC-FAL.1/Circ.3/Rev.4 (2026-05-28) · NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (2022-05 (updated 2024-11-01))
- SUB-01 Which subcontractors (hosting, support, development, monitoring) touch our data or our systems?
- SUB-02 Where are they, and what do they have access to?
- SUB-03 Do your security requirements apply to them in their contracts?
- SUB-04 Will you tell us before you add or change a subcontractor?
What to prepare and a model answer for this family: vendor cyber onboarding grid.
Sources: NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (2022-05 (updated 2024-11-01)) · ENISA, Good Practices for Supply Chain Cybersecurity (2023-06-13) · Directive (EU) 2022/2555 (NIS2), Articles 21 and 23 (2022-12-14)
- PEN-01 When was your software last tested by an independent penetration tester, and what was in scope?
- PEN-02 Can we see a summary of the findings and how each one was fixed?
- PEN-03 May we, or a tester we choose, test the service we use?
- PEN-04 Do you publish a vulnerability disclosure policy, and how fast do you fix critical vulnerabilities?
What to prepare and a model answer for this family: vendor cyber onboarding grid.
Sources: CISA, Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem (2024-08) · CISA and partner agencies, Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products (2025-01-13) · NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (2022-05 (updated 2024-11-01))
- END-01 In which format do we get our data back, and how long do you take?
- END-02 How do you delete our data, including backups, and do you confirm it in writing?
- END-03 How are your accesses, accounts and keys to our systems removed?
- END-04 What help do you give to move to another system?
What to prepare and a model answer for this family: vendor cyber onboarding grid.
Sources: ENISA, Good Practices for Supply Chain Cybersecurity (2023-06-13) · NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (2022-05 (updated 2024-11-01))
Download the questionnaire package
Version 1.0, published 11 November 2026. Generic and anonymised: no terminal, port, client or vendor is named, and no figure comes from a tender.
Vendor questionnaire: questions
Click a question to read the answer.
For the IT and security teams of ports and container terminals who must check a software vendor before connecting its software, and for the vendors and integrators who answer them. It has 34 questions in eight families: access, data, logs, backups, incidents, subcontractors, penetration tests and end of contract.
No. The form runs in your browser only and has no server behind it. Answers stay on your device until you export them as a JSON or CSV file and send that file yourself. The page blocks every network call with its Content-Security-Policy (connect-src 'none').
The questionnaire (YAML, JSON, PDF and the text of the form) is under Creative Commons Attribution 4.0 (CC BY 4.0), like the vendor onboarding grid it comes from: copy and adapt it, even commercially, and credit Port Cyber Alliance. The small form script and its style are under the MIT licence.
Yes. Edit the YAML or JSON file, keep the ids you reuse and add your own, then load it in your GRC tool or adapt the form. Say that you changed it when you share it, as CC BY 4.0 asks.
No. Port Cyber Alliance does not certify vendors or audit terminals. The questionnaire helps a terminal ask the same precise questions every time and helps a vendor answer them with evidence; the terminal decides.
Related pages
Twelve questions on access, network, detection and recovery, about two minutes, answered in your browser.
Checking your own side first?