Got a security questionnaire? Here’s how to answer it.

The short answer

A security questionnaire is a customer's way of asking "can we trust you with our data?" before they sign, or before they renew. Answer honestly, answer consistently, and keep the evidence behind every "yes". A short, accurate answer with a plan for the gaps wins far more contracts than a page of confident ticks you can't back up.

Why you're suddenly getting these

Bigger businesses have to show that their suppliers aren't the weak link. After a string of high-profile attacks that started at a supplier, procurement and IT teams now send questionnaires to almost everyone they work with, from accountants and recruiters to IT firms and cleaners with building access.

They come in all shapes: a spreadsheet with 300 rows, an online portal, a two-page form, or a single email asking "do you have Cyber Essentials?". The questions underneath are usually the same.

What they almost always ask

Topic	What they really want to know
Certifications	Do you hold Cyber Essentials, Cyber Essentials Plus or ISO 27001?
Access	Who can get into your systems, and is MFA on for everyone?
Devices	Are laptops and phones encrypted, updated and protected against malware?
Data	Where is their data stored, who can see it, and how long do you keep it?
Backups	Could you recover if something went wrong? (Here's how to check.)
Incidents	Do you have a plan, and would you tell them quickly if their data was affected?
Policies	Are the rules written down, and do your staff know them?
Your own suppliers	Which other companies touch their data, and have you checked them?

How to answer one without losing a week

1. Read it all before you answer anything. Flag the questions you can't answer yet, and check the deadline.
2. Ask who needs it and why. A quick call with the customer often turns 300 questions into the 20 that actually matter to them.
3. Answer what's true today. Not what you plan to do, and not what your IT provider "probably" does. If you're not sure, find out.
4. Turn gaps into plans. "Not yet. MFA is being rolled out to all staff by the end of November" is a good answer. A false "yes" isn't.
5. Keep your evidence. Screenshots, policies, certificates and reports. If they audit you later, you'll need them.
6. Save every answer. Build a master copy so the next questionnaire takes an hour, not a week.

Answers that cause trouble later

• Ticking "yes" to everything. Contracts often make your questionnaire answers a promise. If something goes wrong and an answer was untrue, that's a much bigger problem than the original gap.
• Different answers to different customers. Keep one master version and work from it.
• Copying your IT provider's answers. Their security isn't the same as yours. Ask them for the parts they handle, and answer the rest yourself.
• Leaving it to the last minute. Some questions need a policy or a setting changed, and that takes time.

The shortcut: certify once, answer faster

A lot of questionnaires let you skip whole sections if you hold a certificate, and some customers only ask for the certificate. Cyber Essentials covers the technical basics most questionnaires start with. ISO 27001 covers policies, risk, suppliers and incidents too, which is why larger customers often ask for it. If you're not sure which one your customers want, here's how to tell.

Either way, the work you do to certify is the same work that answers the questionnaire. Do it once, keep it up to date, and reuse it.

FAQ

Can I just say no to a questionnaire?

You can, but you'll probably lose the contract. If it's genuinely out of proportion to the work, ask the customer if a certificate or a shorter version would do. Many will say yes.

What if I don't have written policies?

Most businesses don't, and that's fixable. A handful of short, plain-English policies covering access, devices, data, backups and incidents will answer most of the policy questions, as long as they describe what you actually do.

Does Cyber Essentials mean I can skip the questionnaire?

Sometimes. Many customers accept it in place of the technical questions, but they'll usually still ask about data handling, incidents and your own suppliers.

Can someone fill it in for me?

Someone can help you work out the answers and the evidence, which is what I do. But the answers have to be true for your business, so you'll always need to be involved.