How should a telecom company run a vendor security questionnaire?

A telecom vendor questionnaire works when it is tiered by how much access a supplier has, asks for evidence instead of yes or no claims, and covers software components, not just policies. Send a short form to low-risk vendors and a deep one, with artifact requests, to those that touch the network.

Why is telecom different?

A telecom operator's suppliers include equipment makers, software vendors for billing and provisioning, managed service providers, and cloud services. Some of them can reach core network functions or subscriber data. NIST's SP 800-161 Rev. 1 addresses this, giving guidance on identifying, assessing and mitigating cybersecurity risks across the supply chain, motivated by reduced visibility into how acquired technology is developed, integrated and deployed.

That visibility gap is what a questionnaire has to close.

How do you tier vendors?

Tiering decides everything else. Score each supplier on two questions: what can it reach, and what happens if it is compromised. A constructed example:

• Tier 1: a provisioning platform vendor with administrative access to network elements and subscriber records. Deep questionnaire, evidence review, contract rights to audit.
• Tier 2: a call analytics tool receiving pseudonymized usage data. Medium form, evidence for key controls.
• Tier 3: a design software license with no data access. A short attestation.

Without tiers, every vendor gets the same long form, no one reads the answers, and the high-risk supplier slips through with a polished PDF.

What should the questions ask for?

Replace "Do you patch promptly?" with requests for proof. Ask for the vulnerability disclosure policy, the date and scope of the last independent test and how findings were closed, how long critical fixes took in the last year, and how customers are notified of incidents. Ask whether they can provide a software bill of materials for what they deliver, in a standard format, and how often it is refreshed.

For software delivered into your network, ask how builds are made, who can release, how updates are signed, and how you can verify them. Ask what open source components sit in the product and who tracks their advisories.

How do sellers answer well?

Answer once, keep an evidence library, and reuse it. A vendor with current policies, a recent test summary, an SBOM and a clear incident process can answer most forms in an afternoon. Do not claim certifications you do not hold, and state scope honestly.

How to check or apply this

1. List suppliers and score each on access and impact, then assign tiers.
2. Write one questionnaire per tier, with required evidence per question.
3. Include software supply chain questions: SBOM, update signing, open source tracking, disclosure process.
4. Set response deadlines, and a rule for what happens on silence or weak answers.
5. Review answers with a security reviewer, and record follow-ups and accepted risks.
6. Put key commitments, such as incident notice and fix timelines, into the contract.
7. Reassess on a schedule and after any incident or major change at the vendor.

For sellers, Safeguard's compliance automation and SBOM tooling can help assemble the evidence a buyer asks for, though the answers must be your own and accurate.

Quick check

Sources

• NIST SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices

Last reviewed: 18 October 2026.