How to Answer a Customer’s Security Questionnaire

More and more small businesses are discovering that winning or keeping a large customer now comes with a security questionnaire: a spreadsheet or online form, sometimes a few dozen questions and sometimes hundreds, asking how you protect data. The way to handle one is to answer honestly, consistently, and with evidence — and to build a library of answers so the next questionnaire takes an afternoon instead of a week.

Why they keep arriving

Your customers are managing their own risk. Their cyber insurers ask how they vet vendors, regulators expect them to oversee third parties, and many have been burned by a breach that started at a supplier. Sending you a questionnaire is how they show they checked. It is rarely personal, and a well-prepared answer can be a competitive advantage over vendors who stall.

What they usually ask

  • Access control: MFA, unique accounts, how access is granted and removed, and how often it is reviewed.
  • Endpoint and email security: endpoint protection, patching, encryption, and email filtering.
  • Data protection: where their data is stored, who can reach it, encryption at rest and in transit, and retention.
  • Backup and recovery: how often you back up, whether backups are tested, and how quickly you could recover.
  • Incident response: whether you have a written plan and how quickly you would notify them of a breach.
  • Policies and training: written security policies and regular security awareness training.
  • Testing: vulnerability scanning and penetration testing; see the difference between the two.
  • Your own vendors and whether you carry cyber insurance.

Some customers use standard formats such as the SIG questionnaire or the Cloud Security Alliance CAIQ; others write their own. The topics overlap heavily, which is why an answer library pays off.

How to answer well

  1. Assign one owner. One person coordinates, pulls in IT and leadership as needed, and makes sure answers match across questionnaires.
  2. Be honest. A questionnaire often becomes part of the contract. “No, scheduled for completion by March” is far better than a “yes” that is not true, which can create legal liability when something goes wrong.
  3. Answer the question asked. Short, specific answers beat paragraphs of marketing. If a control is partly in place, say what is covered and what is not.
  4. Attach evidence when it helps. Policy documents, an insurance certificate, a summary of recent testing, or a screenshot of an MFA policy can settle a question faster than words.
  5. Protect sensitive details. You do not need to send network diagrams or firewall configurations. Offer a summary, or share details under an NDA if the customer truly needs them.
  6. Save every answer. Keep the final answers and evidence in a library you can reuse and update.

Questions that trip people up

  • “Do you have a SOC 2 report?” If not, say so, and describe the controls you do have. Many customers accept that from a small vendor.
  • “Is data encrypted at rest?” Microsoft 365 encrypts stored data, and BitLocker encrypts laptops, so the answer is often yes. Confirm it rather than guess.
  • “Who is your CISO?” Name the person responsible for security, even if it is the owner working with an outside provider or a vCIO.
  • “Do you perform background checks?” This is an HR question, not an IT one. Ask HR rather than assume.
  • “Have you had a breach?” Answer truthfully and precisely, and describe what changed afterward.

Get ready before the next one arrives

Most questionnaires are easy when the basics are in place and written down. A short set of policies — information security, acceptable use, access control, backup, and incident response — combined with MFA, managed devices, tested backups, and regular training covers a large share of most questionnaires. Frameworks like the CIS Critical Security Controls give a sensible order for building them. If customers start requiring a SOC 2 report, plan for it as a project; it takes months, not days.

When an honest “no” puts a deal at risk

Pair the gap with a plan. A dated roadmap for closing it — “MFA for all users by the end of next month, phishing-resistant by the end of the quarter” — often satisfies a customer, especially when the gaps are common ones that can be fixed quickly. The same thinking applies in reverse when you assess your own suppliers; see our guide to vendor risk.

Answer with confidence

Equal Tech Solutions’ cybersecurity services put the controls in place, and our vCIO team helps write the policies and answer the questionnaires for businesses across Cleveland, Chattanooga, and the Southeast. Contact us when the next one lands — or better, before.