How do I answer a customer security questionnaire?
Short answer
Answer honestly and consistently, backed by evidence you can share: policies, a SOC 2 report or ISO certificate if you have one, and descriptions of controls such as MFA, encryption, backups and incident response. Keep a library of approved answers so each new questionnaire is faster.
The details
Never claim a control you do not have. If something is in progress, say so and give a date. A short security overview document often answers most questions before the questionnaire arrives.
Useful next reads and tools
- Work with Ian Job · page
Terms explained
- Encryption
- Encryption transforms readable data into ciphertext that can only be turned back into readable form with the correct key.
- Incident response
- Incident response is the organized process of preparing for, detecting, containing, eradicating and recovering from security incidents, then learning from them.
- Multi-factor authentication
- Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.
- SOC 2
- SOC 2 is an attestation report from an independent CPA firm on a service organization’s controls relevant to security, availability, processing integrity, confidentiality and privacy.
Sources
Related questions
Related Guides
GuideGRC
8 Steps to Prepare for a Security Audit (ISO 27001, SOC 2 or Customer Audit)
How to prepare for an ISO 27001, SOC 2 or customer security audit: scope, control mapping, evidence collection, GRC platforms, mock audits, interviews and managing findings.
Read more GuideGRC
8 Essential Small Business Security Policies to Protect Operations
Establish baseline defense with 8 essential small business security policies covering backups, access control, patching, incident response, and AI use.
Read more GuideGRC
How to Report Security and Compliance Status to Leadership, Clients and Committees
How to build compliance reporting that executives, boards, risk committees and clients can act on: the metrics to include, a one-page report structure, RAG ratings and decision requests.
Read more GuideGRC
How to Build a Security Policy Framework: Policies, Standards and Procedures That People Follow
A practical guide to writing, approving and maintaining information security policies: the policy hierarchy, the core policy set, ownership, review cycles and how to prove people follow them.
Read more