A security questionnaire is how a customer decides whether you are a safe pair of hands for their data. It arrives dressed as a spreadsheet, or a login to a portal, but the decision behind it is commercial: can this business be trusted inside our supply chain, with our customers’ information in its systems? Treat it as paperwork and it stalls your deal at the last step. Treat it as what it is — a request for evidence — and it can move the deal forward.
The sender is rarely trying to catch you out. Their own customers, insurers, and funders ask them the same questions about their vendors, and your answers become part of their file — the record they would produce if anyone asked why they chose you. A weak response doesn’t just raise a question about your security. It leaves the person championing your deal with nothing to defend you with.
The first hour with a questionnaire decides whether the rest is orderly or a scramble. Five moves, before anyone types an answer:
The test for every answer is simple: could you produce the proof within one business day? If the document exists — a dated policy, a coverage report, a test record — the yes is safe, and the evidence can travel with it. If producing the proof would take a week of reconstruction, the honest answer is not yes. It is the truth, with a date and an owner.
That is not underselling yourself. A dated, owned “in progress” tells the reviewer your business manages its security deliberately. A bare “yes” that collapses under one follow-up tells them the opposite — and questionnaires have a way of coming back out of the file: at renewal, at audit, after an incident.
Strip the branding off any customer’s questionnaire and the same eight areas appear, in some order, in some wording. For each: the question behind the questions, and the evidence that answers it. If you can produce the proof within one business day, you are ready for that section. If you can only describe it, that section is your work plan.
They ask what systems you run, what software you rely on, and what customer or client data you hold. The proof that counts: a current inventory of computers, servers, devices, cloud services and software — with who administers each — and a data map showing where that data lives. You cannot defend what you have not listed.
They ask who can reach your systems, and how access is granted and taken away. The proof that counts: MFA enforced on email, remote access, and administrator accounts; a named account for every user, with no shared logins; a current list of administrator rights; a written joiner/leaver process; and a dated record of your most recent access review.
They ask whether your systems are patched and protected, and whether you go looking for weaknesses. The proof that counts: a patching schedule with the most recent patch report, endpoint protection on every device with a coverage list to prove it, a recent vulnerability scan with its results, and email filtering and anti-phishing protection in place.
They ask how you back up — and the only part that really matters: whether you have ever restored. The proof that counts: a documented backup schedule (what, how often, where), backups protected against ransomware, a retention period that matches your policy, and a dated record of a restore test. A schedule is a claim; a restore test is evidence.
They ask what happens on your worst day. The proof that counts: a written incident response plan, however short; the contact list for the first phone calls — IT provider, insurer, bank, legal counsel; notes from a tabletop exercise, a real incident, or lessons learned; and your cyber insurance policy details page, if you carry cover.
They ask whether security in your business is managed or improvised. The proof that counts: an information security policy that is dated and signed, your most recent risk assessment, a risk register naming each significant risk, its owner, and its treatment — and a remediation tracker showing findings closed, not just opened.
They ask whether your staff are part of the defence or part of the gap. The proof that counts: security awareness training records, phishing-awareness activity or results if you run them, signed acceptable-use acknowledgments, and background checks where a role or a contract requires them.
They ask how you vet the businesses that can reach your systems or your data — the same judgement they are making about you. The proof that counts: an inventory of those vendors, signed data-protection or business-associate agreements where they apply, a security review or questionnaire response on file for critical vendors, and breach-notification commitments in the contracts.
For a typical questionnaire, this rhythm works — and most of the time goes on evidence you already have, once someone goes and gets it.
Name the owner, confirm the deadline, sort the questions into the eight areas, and list the evidence each section will need. Send your clarification questions to the sender today — not at the end.
Collect the documents that already exist: policies, reports, records, agreements. Note the gaps plainly as you find them. A gap found on day two is a work item; the same gap found on deadline day is a crisis.
Write the answers with the evidence attached. Where the truth is “in progress,” write it with a date and an owner. Keep the wording factual and short — reviewers read a great many of these, and clarity is itself a credibility signal.
Have a second person read the answers against the evidence, tracing every yes back to its document. Then send — and file the exact response and attachments you sent. The next questionnaire starts from that file, not from memory.
General guidance for planning purposes; it is not legal advice and does not by itself establish compliance with any framework or regulation.
The free Readiness Self-Check asks the evidence question twelve ways and scores what you could produce today; the full checklist turns it into 35 items to work through. If boxes stay unticked, Clyvara’s Risk & Readiness Assessment closes them into a documented risk register and remediation roadmap — so the next questionnaire is answered from a file, not from memory.