How to Answer a Security Questionnaire, Step by Step

It arrives from a procurement address nobody recognizes, with a spreadsheet attached and a due date five business days out. Two hundred rows, a Yes/No column, a Comments column, an Evidence column. It was forwarded to you because you are the closest thing the company has to a security person, and the note on top says the deal cannot move until this comes back. Nothing in the document tells you what a good answer looks like. Every row you get wrong becomes a sentence your employer is held to for the life of the contract.

Why Did You Receive a Security Questionnaire?

Because a customer is about to hand you data, and somebody on their side has to write down why that was a reasonable thing to do. The questionnaire is the artifact that vendor risk teams produce as evidence of their own diligence, which is why it arrives late in the sales cycle and why it cannot usually be talked away.

The volume of these requests tracks a real trend rather than a fashion in procurement. Verizon's 2026 Data Breach Investigations Report found third-party involvement in breaches up 60 percent, with breaches involving a third party now accounting for 48 percent of all breaches. Almost half of incidents now arrive through somebody's supplier, and the buyers sending you a spreadsheet are the ones who read that number and want to know whether you are the supplier in question. The mechanics of how that happens are the subject of a supply chain attack, and every question on the form maps back to one step in it.

For some buyers the request is not discretionary at all.

How to Answer a Security Questionnaire

Nine steps, in order. The first three take an hour and save most of the pain in the other six, which is exactly the hour most first-timers skip because the due date is already close.

Every one of those steps sits inside an exchange with the buyer that is longer than a single send and return, which is the part nobody warns you about.

What Does a Security Questionnaire Ask About?

The wording changes and the ground does not. Cloud Security Alliance organizes the same territory into 197 control objectives structured in 17 domains in its Cloud Controls Matrix, and most buyer questionnaires are a shorter walk over the same map.

A question that does not fit any of these rows is usually specific to the buyer's own regulator, and it is the sort of thing worth asking about rather than guessing at.

Which Standard Security Questionnaires Will You See?

Which one lands on you says a lot about the buyer, how much room there is to negotiate, and whether an answer you write now will be reusable next quarter.

The free one is worth knowing about before a questionnaire arrives. CISA publishes a Vendor Supply Chain Risk Management Template developed by the ICT Supply Chain Risk Management Task Force, described as a set of questions about a supplier's implementation and application of industry standards and best practices. Answering it once, properly, gives you a draft answer for most of what any buyer will later ask, and it costs nothing.

How to Scope a Security Questionnaire Before You Answer It

Scope is the only lever that shortens the document, and it is available exactly once, before you start typing.

Ask the sender four things in one email. Which product and environment is the assessment covering. Which categories of their data will actually reach you. Whether questions outside that scope can be marked not applicable with a short reason. And whether they will accept an existing attestation report in place of the sections it already covers.

Mark a question not applicable only when you can finish the sentence "this does not apply because", and write that reason in the comment field. "N/A" alone reads as evasion and comes straight back as a follow-up. "Not applicable: the product is delivered as a hosted service and no customer data is processed on employee endpoints" reads as a company that understands its own architecture.

Resist the temptation to answer for the whole company. If the buyer is licensing one product, scope the answers to that product, its environment and the team that runs it. Broad scope makes every future answer harder to keep true, and a claim that quietly stops being true is worse than a no.

How to Write a Security Questionnaire Answer

An answer is not a sentence. It is four things stacked, and the reason reviewers send follow-ups is almost always that one of the four is missing.

The four question types each want a different shape.

Yes/no control questions want the box, then one or two sentences in the comment. "Yes. Multi-factor authentication is enforced through our identity provider for all employee accounts and all production access, with no exemption group. Evidence: policy section 4.2 and the enforcement screenshot in the pack."

Describe-your-process questions want a short paragraph with a cadence and an owner in it. A process without a frequency and a named role is a paragraph about intentions. "Access reviews are performed quarterly by the system owner and countersigned by the head of engineering. Removals are actioned within five business days and recorded in the ticket."

Evidence requests want the document, not a description of the document. If you cannot attach it, say what it is, why it is restricted, and what you can offer instead.

Legal attestations want counsel, not you. Anything with the words indemnify, warrant, notify within, or comply with all applicable goes to whoever signs contracts, every time.

Write in the buyer's vocabulary rather than your own product's. If they say "data at rest" and you call it "the storage layer", translate. Encryption at rest is a phrase that maps to a row in their scoring tool, and an answer their tool cannot recognize gets flagged whatever it actually says.

How to Answer a Question When You Do Not Have the Control

This is the moment people freeze, and the wrong instinct is to soften a no into a maybe. A maybe fails twice: it does not satisfy the reviewer, and it costs you the credibility that makes your yes answers worth anything.

The pattern has three parts. The plain no. The compensating control that reduces the same risk today. A remediation date, if you are going to give one, that the person who has to deliver it has agreed to in writing.

"No. We do not currently run a formal bug bounty. Vulnerability reports reach a monitored security mailbox published in our security.txt, and external testing is performed annually by an independent firm. A bounty program is scheduled for Q2 2027, owned by the head of engineering."

Never invent the date. A remediation commitment made in a questionnaire tends to end up quoted in the contract, and a missed one is a breach of a representation rather than a slipped roadmap item.

How to Answer Questions About Your Cloud Provider

A large share of the infrastructure questions are about controls you do not operate. Physical security of the data center, hypervisor patching, media destruction: those belong to your hosting provider, and answering them as if they were yours is both wrong and impossible to evidence.

Attribute the control and then answer the part that is genuinely yours, which is oversight. "Physical and environmental controls are the responsibility of our infrastructure provider and are covered in its current attestation report, which we review annually as part of our subprocessor assessment. Our responsibility begins at the operating system layer, where we run configuration baselines and patching on a defined clock."

That second sentence is the one being marked. The buyer already knows who runs the data center. What they are testing is whether you know where the boundary is and whether anybody at your company looks at the provider's report.

If you are the cloud provider in this exchange, the reusable answer is a published self-assessment. Cloud Security Alliance's STAR Level 1 Security Questionnaire, CAIQ v4, is described as an industry-accepted way to document what security controls exist in IaaS, PaaS and SaaS services, as a set of yes/no questions mapped to the Cloud Controls Matrix. Publishing one to the STAR Registry means a share of buyers stop sending you a spreadsheet at all.

What Evidence Should You Send With a Security Questionnaire?

Attach the artifact, not the assertion. A policy PDF, an attestation report, a training completion export, a summary letter for the last independent test. Evidence is what converts a claim into something the reviewer can put in a file and defend later.

Redact before you attach. A summary letter from a penetration test is normal to share; the full report, with reproduction steps for findings that are still open, is a map of how to attack you and it will sit in a shared drive at a company you have no visibility into. Same rule for network diagrams, raw vulnerability scan exports, and anything naming individual employees. What a buyer needs is scope, date, tester, methodology, severity counts and remediation status.

Check what is covering the exchange before you send anything. Most buyers will sign a mutual NDA on request, and most reviewers expect to be asked.

How to Build a Security Questionnaire Answer Library

The second questionnaire should take a fraction of the first, and it will only do that if you kept the first one properly. A library is not the completed spreadsheets in a folder. It is a table of questions and approved answers that somebody owns.

The failure mode is a library that nobody re-reads. A control gets changed, an answer stays, and eight months later you send a buyer a statement about a system that no longer works that way. Tie the review to the same calendar as your access reviews so it happens whether or not a deal is waiting.

Can a SOC 2 Report Replace a Security Questionnaire?

Sometimes, partly, and it is always worth asking. A reviewer whose scoring tool has a row for each trust services criterion can often close most of the form from the report alone, and many will if you ask before you start typing.

What a report displaces is the section on controls it examined during the period it covers. A SOC 2 report is an accountant's opinion on controls over a stated window, which is stronger evidence than anything you write about yourself, and reviewers know it. What it does not displace is anything outside the audited scope, anything the auditor carved out to a subservice organization, and the complementary user entity controls, which are the things the report assumes the customer will do. Those come back as questions no matter how good the report is.

Ask this way: "We hold a current SOC 2 Type 2 covering security and availability for the product in scope. Would you like the report under NDA, and can we mark the sections it covers as evidenced by it?" A no costs you nothing. A yes can remove half the document.

What Happens If You Answer a Security Questionnaire Incorrectly?

Two things, in sequence. The answer becomes a representation in the contract, because vendor risk teams routinely attach the completed questionnaire as a schedule or reference it in the security addendum. Then somebody checks.

The public example of that mechanism is the federal one, and it is worth knowing even if you never sell to a government buyer, because the shape is the same everywhere. Under DFARS 252.204-7020, a defense contractor performs a Basic Assessment against NIST SP 800-171 and posts a summary score, which the clause itself describes as carrying a confidence level of low because it is self-generated. The government may then conduct a High Assessment, which includes verification, examination and demonstration of the contractor's system security plan to validate that the requirements were implemented as described. A self-assessment is an opening position, and the party receiving it has a documented route to checking whether it was true.

Commercial buyers do the same thing with softer instruments: an audit right in the contract, a request for the underlying evidence, a comparison against your attestation report, or the questions their own auditor asks them a year later. The exposure is not usually a regulator. It is a customer who relied on a sentence you wrote, and a breach that reaches data the sentence said was protected.

How Long Does a Security Questionnaire Take?

A short form from an organized buyer, answered by a company with a current library and a recent attestation report, is a morning. A two hundred question spreadsheet answered from scratch by a company that has never done one is two to four weeks of elapsed time, most of it spent waiting: for scope confirmation, for engineering to answer three questions, for counsel to look at the attestations, for the buyer to respond to the follow-up round.

The elapsed time is dominated by handoffs rather than typing, which is why the fix is the intake process and the named owners rather than faster writing. Companies that answer these well are not writing better prose. They are answering fewer questions, from a library, with evidence already redacted and waiting.