A Practical Cybersecurity Questionnaire for Physical-Infrastructure Vendors

Why a camera or access controller is a cyber risk

A physical-infrastructure vendor does not merely install hardware; it hands you internet-connected systems that sit on your network and watch your site. Video cameras, door controllers, turnstiles, intercoms, and perimeter sensors run embedded software, hold credentials, and communicate over the network. Once connected, an unpatched device with a default password is a legitimate network presence an attacker can move through, regardless of how strong the door lock is.

Cyber supply chain risk management therefore treats the procurement of such components as an assessment of the supplier and the product together. NIST SP 800-161 frames this as evaluating the full chain from design to integration and deployment, while CISA's Vendor SCRM template groups the questions into governance, information security, physical security, personnel security, and resilience. Your questionnaire is the practical way to bring that framework down to one purchase decision.

Design the tool: tier first, then ask

The most common mistake is sending a 300-question bank to every integrator. That produces delayed, generic answers and trains vendors to say yes to everything. Instead, decide what the vendor actually touches before drafting questions.

A maintenance-only contractor with badge access to a mechanical room poses a different risk than the integrator that configures your video management server, holds admin credentials, and connects your perimeter sensors to the office network. Categorize vendors as high, medium, or low by the data they can reach, the systems they administer, and whether they work on a continuously connected basis. Reserve the full questionnaire for high and medium tiers; let low-tier vendors answer a five-question screening.

The five blocks that carry the risk

Keep the questionnaire to one page by focusing on the controls that most directly affect physical systems. Each block is scored yes, partially, or no, with a short evidence field.

The first block is device and firmware hygiene: how the vendor tracks the software versions of cameras, controllers, and gateways it supplies, how it learns about vulnerabilities, and how quickly it can deliver a tested patch. The second is credentials and access: whether default passwords are changed at commissioning, whether administrative accounts use multi-factor authentication, and who holds the master credentials.

The third block is network behavior: segmentation of video and control traffic from the business network, whether devices can reach the internet, and logging of who connects. The fourth is supply chain transparency: named sub-contractors, the origin of firmware and hardware, and whether a controlled bill of materials exists so that components received or repaired in transit are not silently substituted. The fifth is response and handover: how the vendor detects an incident on the systems it manages, who you call, and what documentation and recovery support it leaves behind.

• Do default credentials get changed at commissioning, and are they unique per device?
• Are admin and maintenance accounts protected with multi-factor authentication, with role separation?
• Are video, access-control, and building-management networks segmented from the office network?
• How does the vendor learn about firmware vulnerabilities and deliver tested patches, and in what time frame?
• Can the vendor name its sub-contractors and provide a controlled bill of materials for hardware and firmware?
• Who holds root credentials, and is access logged and reviewed?
• What happens on an incident: detection duties, notification window, and retained evidence?

Score the answers and verify the claims

A useful scoring model weights each block by the tier of the vendor and the sensitivity of the asset. For example, firmware patching and credential management typically carry the highest weight for an access-control integrator, while supply-chain transparency matters more for a vendor supplying edge hardware. Set a threshold below which you require a remediation plan, and mark answers that need follow-up rather than accepting them as final.

Verification matters because questionnaire answers describe intent, not reality. Ask for evidence: a patch-management policy, a certificate such as an ISO/IEC 27001-aligned statement of applicability, a network diagram, or audit results. Compare claims with observable signals, for example whether a vendor that promises disciplined patching can show a documented test cycle. For the highest tier, combine the questionnaire with an on-site sampling of one or two devices to check that factory defaults are actually gone and firmware is current.

Lock the posture into the contract

A questionnaire is only as durable as the obligation behind it. State in the procurement agreement that the vendor must maintain the controls it confirmed, define a notification window for security incidents affecting your systems, and specify what evidence it must produce on request and on re-assessment.

In regulated sectors this is not optional. For organizations in the Russian banking system, Bank of Russia standard STO BR IBBS-1.4-2018 sets expectations for managing information-security risk when substantial functions are outsourced, including periodic assessment of the service provider and duties that survive the handover. Even outside banking, the same principle applies: outsourcing work does not transfer your accountability for the security of your site and data.

Limitations you should name openly

A vendor questionnaire cannot detect a compromised build, a malicious insider, or a backdoored component, and it cannot see how a vendor actually behaves on site. It is a screening instrument that reduces, but does not eliminate, risk.

Be equally clear about what the tool is not. It does not replace an on-site audit, penetration testing, or continuous monitoring of the systems once installed. Where uncertainty remains after scoring, record the residual risk and decide deliberately, rather than assuming a clean questionnaire means a safe deployment.