A security questionnaire is a set of contractual statements about how your business operates, and it will be quoted back at you if something goes wrong. Answer it as you would a warranty, because that is effectively what it is. The NCSC publishes supplier assurance questions that most buyer questionnaires are built from, and reading them tells you what is coming before it arrives.
Honesty beats optimism
The temptation is to answer for the organisation you intend to become. It rarely ends well. A yes to a control you do not operate becomes a misrepresentation when a breach investigation examines it, and buyers increasingly ask for evidence rather than accepting the answer alone. A no with a plan and a date reads far better than most people expect, and it starts a more useful conversation: buyers understand that suppliers mature over time and they are far more concerned by discovering later that an answer was wrong.
Build an answer library once
The same forty questions arrive in different formats from every customer. Write your canonical answers once, with the supporting evidence referenced against each, and review the set quarterly. That turns a two-day exercise into a two-hour one and removes the inconsistency that occurs when different people answer different questionnaires from memory in a hurry. Keep the evidence itself in one place too: certificates, your latest test summary, the patching policy, the incident response plan and a current data flow description. Date every document, because an undated policy invites the question of when it was last reviewed.
“The question that catches suppliers out is the one about penetration testing frequency, because the honest answer is often that the last test was two years ago. Buyers notice the gap between the policy you attach and the date on the report. If those two documents disagree, expect a follow-up call, and have the booking made before it comes.”
See also: Maintain Clean and Fresh Upholstery
What to share and what to hold back
Never send a full penetration test report to a customer. It describes exactly how to attack you, and once sent you have no control over where it goes. An executive summary or an attestation letter confirming scope, dates and remediation status satisfies almost every request. Where a customer insists on detail, offer a redacted version under a non-disclosure agreement or a supervised review. An accredited UK penetration testing company will produce these formats as standard, which saves you writing them yourself.
Pushing back proportionately
Some questionnaires are written for a different kind of supplier and ask about controls that make no sense for your service. It is reasonable to mark those not applicable with a one-line explanation rather than inventing an answer. It is also reasonable to ask which questions are contractual requirements and which are informational, since that focuses your effort where it changes the outcome. Buyers rarely mind the question and often have not thought about it themselves. Where a genuine gap exists and the contract depends on closing it, request a quote for testing or certification early enough that the work is finished before the deadline rather than promised in the response.
Frequently asked questions about security questionnaires
These questions come up whenever a sales team meets enterprise procurement.
Who should own the answers?
One person, usually in security or operations, with sales providing context. Distributed ownership produces contradictory answers across customers, which is discovered at the worst possible moment during an audit.
Do certifications reduce the questions?
They shorten them. Many buyers accept certification in place of a whole section, and the remaining questions tend to be about your specific service, which is where the useful conversation happens anyway
By
By
