Free printable checklist
EcoVadis and security questionnaire IT evidence checklist
A big customer has asked for an EcoVadis rating or sent a security questionnaire, and some of the questions land on IT. This checklist lists the IT and data security documents to gather, how to make them count, and which parts of the assessment need someone outside IT.
- Timeframe
- Before you start the questionnaire
- Steps
- 21
- Last reviewed
- October 2, 2026
- Price
- Free, no sign-up
Who this is for: Owners, quality managers and office managers at suppliers asked for an EcoVadis rating or a customer security questionnaire.
0 of 21 done
Your checkmarks are saved in this browser only. The printout is a blank copy.
1.Get ready: understand what is being asked
0 of 4Half an hour of setup here saves days of hunting for files later.
An EcoVadis rating is a paid subscription whose annual fee varies by company size, while a customer questionnaire has its own format and deadline; the same evidence usually serves both.
Who: Owner
EcoVadis scores four themes: Environment, Labor and Human Rights, Ethics, and Sustainable Procurement; IT evidence mainly supports Responsible Information Management under Ethics.
Who: Owner
EcoVadis says it does not credit informal documents without the company name or logo or an issue or review date.
Who: Office manager
An index lets you answer the next questionnaire in hours, and shows a reviewer you manage documents on purpose.
Who: Office manager
2.Policies: what you commit to
0 of 6EcoVadis rewards formal written policies and treats missing evidence as a sign of a weak management system (methodology).
This is the core document for the information side of the assessment. Our free Information Security Policy generator builds one in plain language.
Who: Owner and IT provider
It explains how you collect, use, store and delete personal data about employees, customers and suppliers.
Who: Owner or HR
Reviewers look for who gets access to what and how it is removed. Our Password Policy generator covers the password side.
Who: IT provider
It shows you know who does what when something goes wrong. Start from our free incident response plan template.
Who: Owner and IT provider
It states what you back up, how often, where copies are kept and how often you test a restore. See our Data Backup and Recovery Policy generator.
Who: IT provider
Sustainable Procurement is one of the four themes, so show that the companies you buy IT from and recycle IT through are held to written standards.
Who: Purchasing
3.Actions: proof that you do it
0 of 7A policy with no proof behind it scores poorly. Dated screenshots, reports and logs are the proof.
Multi-factor authentication (MFA, a second check such as a code on your phone) is a basic control, and CISA recommends it for all services, especially email and VPNs; a dated admin report or screenshot proves it.
Who: IT provider
A dated note that someone checked who has access, and removed people who left, shows your access rules are followed.
Who: IT provider
CISA recommends regularly testing the availability and integrity of backups, and a dated restore log is the proof.
Who: IT provider
Completion reports with names and dates show training actually reaches everyone, not just that a course exists.
Who: HR
Data destruction and recycling certificates from an R2 or e-Stewards certified recycler show old devices were wiped and recycled responsibly, which supports both data protection and the Environment theme. The FTC warns that simply deleting files is not enough.
Who: IT provider
Even a one-page record of a tabletop exercise shows your incident plan is used, not just written.
Who: Owner and IT provider
Valid certifications and third-party audits are one of the seven management indicators EcoVadis scores (methodology), so include any you already hold; none is required.
Who: Owner
4.Results and upkeep
0 of 4EcoVadis scores results as well as policies and actions; numbers like the share of staff trained or accounts with MFA count, and KPI reports stay valid for 2 years.
Who: IT provider and HR
EcoVadis treats policies older than 8 years as expired and scorecards are valid for 12 months, so a yearly review keeps evidence current for each reassessment.
Who: Owner
A policy promising monthly restore tests next to a log showing one test a year raises questions a reviewer will notice.
Who: Office manager
Energy, waste, health and safety, working conditions, anti-corruption and supplier practices are all EcoVadis criteria that need operations, HR, finance and purchasing; IT documents alone will not carry a rating.
Who: Owner
Who does what on this checklist?
Every step names an owner so nothing waits on a single person. Hand each owner their rows below, and agree ahead of time who covers if someone is out.
| Owner | Steps | Where they appear |
|---|---|---|
| IT provider | 6 | Policies: what you commit to; Actions: proof that you do it |
| Owner | 5 | Get ready: understand what is being asked; Actions: proof that you do it; Results and upkeep |
| Office manager | 3 | Get ready: understand what is being asked; Results and upkeep |
| Owner and IT provider | 3 | Policies: what you commit to; Actions: proof that you do it |
| HR | 1 | Actions: proof that you do it |
| IT provider and HR | 1 | Results and upkeep |
| Owner or HR | 1 | Policies: what you commit to |
| Purchasing | 1 | Policies: what you commit to |
How do you make this checklist work in real life?
A checklist only helps if the right people know it exists before they need it. These habits make the difference.
- Write policies to describe what you actually do. A short, true policy with dated proof is stronger than a long template nobody follows.
- Put the company name in the body text of each document, not just in a logo; EcoVadis guidance on supporting documents asks for the name and a date.
- Keep last year’s evidence when you add this year’s. Reviewers and customers like to see a history, not a single snapshot.
- Answer large customer security questionnaires from the same evidence folder so your answers stay consistent across customers.
Want help with the steps that need an IT provider?
Preferred Data Corporation has supported businesses from High Point, NC since 1987. These services cover the technical steps on this list.
Frequently asked questions
What is EcoVadis?
EcoVadis is a paid sustainability rating many large companies ask their suppliers to complete. It scores 21 criteria across four themes, Environment, Labor and Human Rights, Ethics, and Sustainable Procurement, on a 0 to 100 scale, based on the documents you submit and outside sources.
Which part of EcoVadis covers IT and information security?
Mainly the Responsible Information Management criterion in the Ethics theme (methodology). Disposal of old IT equipment also touches the Environment theme, and how you choose IT vendors touches Sustainable Procurement.
Does EcoVadis require an information security policy?
EcoVadis does not publish a fixed list of required documents. It scores whether you have formal policies, actions and results for each criterion that applies to you, and treats missing formal evidence as a weakness (methodology). A written, dated information security policy is the natural place to start.
How long is an EcoVadis rating valid?
A scorecard is valid for 12 months from publication, so plan to refresh your evidence every year. Policies count for up to 8 years and reports on key numbers for 2 years.
Do we need ISO 27001 or another certification?
No certification is required. EcoVadis counts valid certifications and third-party audits as one of seven management indicators (methodology), so they help if you already have them, but well-kept policies and proof matter on their own.
How much of our EcoVadis score is IT?
Less than most people expect. Each theme is weighted from 1 to 4 based on your industry, size and risk profile (methodology), and IT evidence mostly feeds one of the 21 criteria. Treat IT as one part of a company-wide effort.
Sources
- EcoVadis: Sustainability Rating methodology disclosure document
- EcoVadis Support: Understanding supporting documents
- EcoVadis: Plans and pricing for rated companies
- CISA: #StopRansomware Guide (MFA and backup recommendations)
- EPA: Certified electronics recyclers
- FTC: Protecting Personal Information, A Guide for Business
Related free resources
GuideEcoVadis and Customer Security Questionnaires: What US Manufacturers Need to KnowWhat EcoVadis ratings and customer questionnaires ask of US manufacturers, why customers ask, what EU law does and does not require, and which parts your IT can help prove.
Policy templateInformation Security PolicyEstablish the core security program every insurer, auditor and customer now asks about: data classification, access control, patching, encryption, logging and vendor risk.
Policy templateVendor Risk Management PolicyChoose and monitor the vendors that hold your data or reach your systems: a vendor list, simple risk tiers, security questions, contract clauses, remote access rules and a clean exit.
Policy templateData Retention and Destruction PolicyDecide what records to keep and for how long, with a sensible default schedule, legal holds, and secure destruction of paper and devices following NIST SP 800-88.
Policy templateData Protection and Privacy PolicySet internal rules for the personal and confidential data you hold: collect less, limit access, share carefully with vendors, handle requests, and respond to a breach under North Carolina law.
Policy templateIT Asset Disposal PolicyRetire old computers, phones, servers and copiers safely: track every device, wipe or destroy data to NIST SP 800-88, get certificates of destruction, and recycle through certified recyclers.
Need the IT side of a supplier assessment done right?
Preferred Data helps manufacturers and distributors put real security controls in place and document them, so the evidence a customer asks for already exists.
Preferred Data Corporation, 1208 Eastchester Drive, Suite 131, High Point, NC 27265