A customer sent us a security questionnaire. Where do we start?

Assign someone to coordinate the response, then establish which product and service the customer is assessing. Answer for that scope and your current practices. A policy for another team, or a control you plan to introduce next quarter, is not evidence that the requested control operates today.

Customers use these questionnaires to assess supplier risk. The NCSC’s supplier assurance questions show the kinds of security practices a buyer may examine.

Sort questions by who can answer them

Send technical questions to the people operating the systems. Give contractual and data-handling questions to the appropriate owner. Keep a single coordinator responsible for resolving contradictions and returning the agreed response.

For each answer, capture the scope, supporting evidence and the person who confirmed it. An answer about encryption should identify the relevant data and circumstances. “We use encryption” leaves too much unstated.

State limitations clearly

If a question asks whether all systems use single sign-on and one critical application does not, do not tick an unqualified yes. Describe the coverage and the exception. If remediation is planned, separate the current position from the planned change and avoid committing to dates that nobody has approved.

For ambiguous questions, ask the customer what outcome they need to assess. You may meet the underlying requirement differently from the example in their spreadsheet.

Share evidence deliberately

Use the least sensitive material that answers the question. A policy excerpt or redacted test result may be sufficient. Avoid sending credentials, raw customer records or detailed internal network information as questionnaire attachments.

Check any sharing restrictions on audit reports before distributing them. Keep track of which version was shared and with whom, especially when an answer depends on a report’s scope or reporting period.

Reuse reviewed answers

Maintain an answer library with an owner and review date. Recheck an answer when the underlying system changes, and before using it for a different product. Old answers can be more dangerous than blank cells because they look finished.

Yrso’s document reviews and controlled document sharing can support this work. Evidence slots let you collect a manual report once and link it to the checks it supports. The customer may still need a response in their own questionnaire format.

Read next: Can we keep using our existing tools for compliance?