figma guide
Designing security questionnaires and vendor onboarding UI in Figma: intake, scoring, and handoff
Design security questionnaire and vendor onboarding UI in Figma with intake forms, SIG/CAIQ templates, reviewer scoring, approval gates, and Dev Mode specs for enterprise Security and Procurement admin.
- Published
- Updated
- Jul 21, 2026
- Read time
- 8 min
- Level
- Intermediate
Quick answer
Security questionnaire UI lets Procurement and Security collect vendor evidence, score responses, and gate integrations before apps go live—not email a spreadsheet back and forth. Design a vendor intake portal with company profile and data classification; questionnaire builder from templates (SIG Lite, custom); vendor response workspace with save progress and attachment uploads; reviewer scoring panel with findings, risk tier, and remediation; and approval gate that blocks third-party app connection until complete. Start from the Figma guides hub and pair with vendor risk assessment, app approvals, compliance exports, DLP, and Dev Mode handoff.
Who this is for
- Product designers building vendor intake wizards, questionnaire editors, and review dashboards for enterprise Security, Procurement, and GRC admin consoles.
- Design system teams aligning risk tier badges with badges, forms, and progress steppers.
- Engineers implementing template versioning, conditional questions, document uploads, scoring rubrics, and integration blocks tied to OAuth linking.
Vendor intake hub (internal admin)
VendorIntakeHub
├── Header: Vendor onboarding · [ New request ] [ Templates ] [ Export ]
├── Summary: 8 in review · 3 awaiting vendor · 2 blocked integrations
├── Filters: Status · Risk tier · Data class · Owner
└── Row: Acme Analytics · SaaS · High data · Review in progress · Due Aug 5| Column | Content |
|---|---|
| Vendor | Legal name, product, website |
| Requester | Internal sponsor (RevOps, Eng) |
| Data classification | Public / Internal / Confidential / Regulated |
| Questionnaire | Template name, version, completion % |
| Risk tier | Low / Medium / High / Critical (post-review) |
| Status | Draft / Sent / In review / Approved / Rejected / Remediation |
| Integration block | Linked pending app approval |
Verdict: intake is a workflow object, not a one-shot form—track from internal request through vendor response, Security review, and go-live gate.
Internal request form (sponsor starts)
Procurement or business sponsor kicks off before vendor gets access:
InternalVendorRequest
├── Vendor: Acme Analytics Inc. · Product: Acme BI Cloud
├── Use case: Sales forecasting dashboards · 200 users
├── Data types: ☑ Customer PII ☑ Usage metrics ☐ Payment cards
├── Integration: OAuth to Salesforce · [API scopes preview](/designing-connected-accounts-and-oauth-linking-ui-in-figma/)
├── Questionnaire template: ● SIG Lite 2026 ○ Full SIG ○ Custom NDA + 12 questions
├── Target go-live: 2026-09-01
└── [ Send to vendor ] [ Save draft ]| Field | Why it matters |
|---|---|
| Data classification | Drives template depth and reviewer assignment |
| Integration preview | Surfaces DLP and scope concerns early |
| Template pick | Low-risk gets Lite; regulated data gets Full SIG + SOC2 doc request |
| Sponsor | Accountability—not anonymous vendor submissions |
Auto-route: Confidential + customer PII → Security + Legal review queue; Internal-only analytics → Security solo.
Link duplicate vendor detection: “Acme Analytics reviewed 2025-11 — [ Reuse assessment ] or [ New review for new product ].”
Vendor response portal (external)
Vendors need a focused workspace, not your internal admin UI:
VendorPortal
├── Header: Security questionnaire · Acme Analytics · Due Aug 5
├── Progress: 68% complete · 12 of 18 sections
├── Section nav: Company info · Access control · Encryption · Incident response · ...
├── Current: 4.2 Do you enforce MFA for all admin accounts? ● Yes ○ No ○ N/A
├── Evidence: [ Upload SOC2 Type II ] [ Upload pen test summary ]
├── Comments: Reviewer asked for clarification on 4.2 — see thread
└── [ Save ] [ Submit for review ]| Pattern | Implementation |
|---|---|
| Save progress | Auto-save; email magic link return |
| Conditional questions | ”If Yes to 4.2, show 4.2a vendor MFA methods” |
| Attachments | SOC2, ISO, pen test—use file upload patterns |
| Clarification threads | Per-question comment thread—not global email |
| Submit lock | Warn if required evidence missing; allow submit with gaps flagged |
Use accordions for long SIG sections; progress stepper for completion.
Accessibility: vendor portal is external—WCAG matters; pair with a11y plugin guidance for form labels and error states.
Reviewer scoring panel (Security)
ReviewPanel
├── Vendor: Acme Analytics · SIG Lite 2026 · Submitted Jul 18
├── Auto-score: 78/100 · 2 critical gaps · 4 minor gaps
├── Section: Access control · Question 4.2 MFA for admins
│ ├── Response: Yes
│ ├── Evidence: SOC2 page 14 referenced
│ ├── Reviewer: ● Accept ○ Gap ○ Needs clarification
│ └── Finding note: MFA enforced; matches SOC2 CC6.1
├── Risk tier recommendation: ● Medium ○ Low ○ High
├── Remediation required: Pen test older than 12 months — request refresh
└── [ Approve with conditions ] [ Request remediation ] [ Reject ]| Review action | Outcome |
|---|---|
| Accept | Question closed; contributes to score |
| Gap | Finding logged; may block approval |
| Needs clarification | Vendor notification + due date |
| Approve with conditions | Go-live allowed; remediation tracked |
| Reject | Block app approval; notify sponsor |
Show side-by-side: vendor answer + linked evidence PDF snippet + last year’s vendor risk score for regression comparison.
Bulk review for low-risk sections; expand critical controls (encryption, subprocessors, breach notification) by default.
Approval gate and integration linkage
Questionnaire completion should gate technical integration:
ApprovalGate
├── Vendor: Acme Analytics · Risk tier: Medium (approved with conditions)
├── Conditions: Upload refreshed pen test by 2026-10-01
├── Integration: Salesforce OAuth · Status: Blocked → Approved
├── [ Enable app in marketplace ] [ Notify sponsor ]
└── Audit: Approved by @security-admin · 2026-07-21| Gate state | Integration behavior |
|---|---|
| Not started | App request queued |
| In review | OAuth connect disabled; sponsor sees “Security review in progress” |
| Approved | Connect enabled; log in audit log |
| Approved with conditions | Connect enabled; remediation task open |
| Rejected | Block + appeal path for sponsor |
Annual re-assessment trigger: link to access review for app owners certifying integration still needed.
Template library (admin)
QuestionnaireTemplates
├── SIG Lite 2026 · 18 sections · Used 142 times
├── Full SIG 2026 · 86 sections · Regulated vendors
├── Custom: AI vendor addendum · 8 sections
└── [ Duplicate ] [ Edit ] [ Deprecate old version ]| Template type | When to use |
|---|---|
| SIG Lite | Standard SaaS, internal data only |
| Full SIG | Customer PII, HIPAA, financial data |
| Custom addendum | AI/ML subprocessors, biometric data |
| Lightweight 12Q | Low-risk tools, no production data |
Version templates—vendors in flight stay on old version; new requests get latest. Show version in portal header.
Pair AI vendors with content classification questions about training data use.
Posture and compliance linkage
| Control | Questionnaire evidence |
|---|---|
| SOC2 CC9.2 | Vendor risk assessment documentation |
| Vendor risk program | Score history and tier assignment |
| Compliance export | Full questionnaire + reviewer findings PDF |
| Posture dashboard | ”3 high-risk vendors past reassessment due” |
PostureGapCard — Third-party risk
├── 3 vendors overdue for annual SIG refresh
├── 1 integration live without completed questionnaire (policy violation)
└── [ View vendor inventory ] [ Send renewal campaigns ]Wire rejected vendors to DLP blocks if OAuth was attempted before approval.
Comparison: questionnaire vs vendor risk assessment vs app approval
| Surface | Primary question |
|---|---|
| Questionnaire onboarding | ”Does vendor meet our controls before we connect?” |
| Vendor risk assessment | ”What is ongoing risk tier and review cadence?” |
| App approval | ”Can members install/connect this app?” |
Onboarding questionnaire feeds initial risk tier; annual reassessment reuses shortened template. App approval is the technical gate; questionnaire is the evidence gate.
Common mistakes
| Mistake | Why it hurts | Fix |
|---|---|---|
| Email PDF questionnaires | No audit trail, version chaos | Vendor portal with save + submit |
| Same template for all vendors | Reviewer fatigue on low-risk | Template picker by data class |
| Review decoupled from OAuth gate | Shadow integrations | Block connect until approved |
| No clarification threads | Email ping-pong | Per-question comment thread |
| Score hidden from sponsor | Business can’t prioritize remediation | Sponsor read-only summary view |
| No version on template | Inconsistent assessments | Pin version per submission |
| Reject without appeal path | Stalled procurement | Sponsor appeal to Security lead |
| Evidence uploads without virus scan note | Trust gap in copy | ”Files scanned; max 25MB” |
| One-off UI for renewals | Reinvent workflow yearly | ”Renew assessment” clones prior |
| Questionnaire orphan after approve | No ongoing monitoring | Link to vendor risk tier + annual due |
Recommended workflow
- Design internal vendor request form with data classification and template selection.
- Build vendor response portal with sections, attachments, and clarification threads.
- Create reviewer scoring panel with accept/gap/clarify and risk tier recommendation.
- Wire approval gate to third-party app connect and marketplace enablement.
- Add template library with versioning and SIG Lite / Full variants.
- Connect reassessment due dates to posture dashboard and vendor risk inventory.
- Annotate gate states and audit events in Dev Mode.
FAQ
Vendor refuses Full SIG?
Risk-based escalation—reject or approve Lite with conditions + executive exception logged in audit log.
Reuse last year’s assessment?
Allow for unchanged product—“Confirm no material change” attestation + delta questions only.
Multiple products from same vendor?
Separate questionnaire per product—shared company profile; distinct integration scopes.
Link to webhooks vendors?
Developer-focused addendum—event payload classification, retry security, signing keys.
Procurement vs Security ownership?
Split UI: sponsor owns intake; Security owns review panel; both see shared status hub.
Next steps
- Design vendor risk assessment and third-party security reviews UI in Figma — ongoing tier and cadence
- Design third-party app approvals and marketplace UI in Figma — technical connect gate
- Design compliance exports and legal hold UI in Figma — auditor evidence pack
- Design DLP and external sharing restrictions UI in Figma — data exposure controls
- Design security posture dashboard and compliance checklist UI in Figma — overdue reassessment gaps
§ Keep reading