A client sent you a security questionnaire. Answer it honestly, and only once

A spreadsheet arrives on a Friday

You know the type. A larger client, or a prospect you very much want, sends a spreadsheet with a hundred-odd security questions and a deadline next week. Some questions are clear (“Do you enforce multi-factor authentication?”), some are written for a bank (“Describe your segregation of duties within the SOC”), and all of them seem to want a yes.

Here is how I’d handle it. Answer every question truthfully, using “yes”, “partially” or “no”, with one or two sentences of detail. Where the answer is no, say what you’re doing about it and by when. Keep the answers, with evidence, in a single answer file you reuse for the next questionnaire. My firm opinion: an honest “not yet, planned by March” beats a yes you can’t back up. A false yes can come back to bite you the day there’s an incident or a claim, and it’s the sort of thing clients remember.

The questions that come up every time

Whether a client writes its own or borrows from a standard like the Shared Assessments SIG or the Cloud Security Alliance’s CAIQ, the same topics appear again and again. If you can answer these well, you can answer most questionnaires.

• MFA: on email, remote access, admin accounts and cloud apps.
• Access control: who has access to what, how access is reviewed, and how quickly leavers are removed.
• Backups: what is backed up, how often, whether backups are kept separate from production, and when you last tested a restore.
• Encryption: laptops and phones encrypted, data encrypted in transit and at rest.
• Endpoint protection and patching: what runs on your computers, and how quickly updates are applied.
• Email security: filtering, SPF, DKIM and DMARC.
• Training: whether staff get security awareness training and phishing tests.
• Incident response: whether you have a written plan, who is on it, and how fast you’d notify the client.
• Policies: a written information security policy, acceptable use, data retention.
• Third parties: which subcontractors and cloud services touch the client’s data.
• Insurance: whether you carry cyber insurance, and how much.
• Physical security and data location: where data is stored, and who can get into the office or server room.

Most of these map onto the NIST Cybersecurity Framework, which helps if a client asks which framework you follow. You don’t need to claim compliance with it; it’s enough to say you use it as a reference and can show how.

How to answer ‘partially’ without making it sound worse than it is

A “partially” with no detail invites suspicion. A “partially” with scope, reason and date reads as a vendor who knows its own systems. Here is the formula I’d use: what is covered, what isn’t, why, and when that changes.

Worked example. Imagine a 35-person marketing agency answering three common questions.

• Is MFA enforced for all users on all systems? Partially. MFA is enforced for all 35 Microsoft 365 accounts and our accounting system. Our legacy project-management tool does not support it; we are moving to a replacement that does, with completion planned by 31 March 2027.
• Are backups tested? Yes. Microsoft 365 data is backed up daily to a separate service. We restore a sample of files and one full mailbox each quarter; the most recent test was 2 September 2026, and the record is available on request.
• Do you have a written incident response plan? No. We are drafting one using a standard template, with names and contact details for each role, and will adopt it by 30 November 2026. In the meantime, our IT provider’s escalation process applies, and we would notify you within the timeframe in our contract.

Notice that none of these are flattering, and all of them are believable. The third, frankly, is the one most small firms would be tempted to fudge, and the one a client’s security team is most likely to ask for a copy of. Our incident response plan template is a quick way to turn that no into a yes.

Build the answer file once

The second questionnaire takes half the time of the first, and the third takes an afternoon, provided you keep the answers somewhere sensible. This is the routine I’d set up for a client.

1. Make one document with a heading for each topic above. Under each, write your current answer in two or three plain sentences.
2. Attach evidence: a screenshot of the MFA policy, the last backup test record, the training completion report, the policy documents. Date every piece.
3. List open gaps separately, each with an owner and a target date. This becomes your security to-do list, which is useful in its own right.
4. Answer each new questionnaire from the file, rewording to fit the question. When a question is new, write the answer into the file too.
5. Review it every six months, and whenever something changes (new system, new IT provider, a closed gap). Stale answers are how honest firms end up saying untrue things.
6. Have the owner or a manager sign off each submitted questionnaire. The answers are a representation to a client and may be referenced in the contract.

A written information security plan does a lot of this work for you, because many questions are effectively asking “show me the policy”.

If you want an independent view of where you stand before the next questionnaire arrives, our free Technology Health Assessment rates cybersecurity and business continuity in plain language: 30 minutes of data collection, a report the next day, yours to keep. Book a time here.

What I wouldn’t do

I wouldn’t let a salesperson fill it in alone. They want the deal, and the answers need to be right more than they need to be pleasant.

I wouldn’t answer “N/A” to questions you’d rather skip. If a question genuinely doesn’t apply (you have no server room), say why in a sentence.

And I wouldn’t treat the questionnaire as the end of it. Some clients write security requirements into their contracts, and cyber insurers ask similar questions at renewal. For what it’s worth, the firms that find questionnaires easy are the ones doing the underlying work: MFA, access reviews, same-day removal of leavers, tested restores and a written recovery plan. That’s the work our cybersecurity service covers, and we help clients with insurance and security questionnaires as part of it.

Related services

• Cybersecurity services
• Written information security plan
• Incident response plan template
• Small business cybersecurity checklist