A security questionnaire is a list of questions a customer sends to check how you protect their data before they buy. The fastest way to answer one well is to treat it as an evidence exercise, not a writing exercise.
What is a security questionnaire?
Security questionnaires (also called vendor security assessments or vendor risk questionnaires) are part of a customer’s third-party risk process. They are common in B2B software sales, especially once a deal reaches procurement or legal review.
Some customers use standard formats:
- SIG (Standardized Information Gathering) from Shared Assessments, available in shorter and fuller versions such as SIG Lite and SIG Core.
- CAIQ (Consensus Assessments Initiative Questionnaire) from the Cloud Security Alliance, mapped to its Cloud Controls Matrix.
- HECVAT for vendors selling to higher education.
Many customers send their own spreadsheet or portal form. The topics overlap heavily: access control, encryption, logging, incident response, vulnerability management, vendor management, business continuity, secure development and privacy.
Step 1: Read the whole questionnaire and confirm the scope
Before answering, check which product, environment and legal entity the customer is assessing, the deadline, and whether they want evidence attached or only answers. Ask the customer if a recent SOC 2 report, ISO 27001 certificate or security overview could replace part of the questionnaire. Many will accept that for overlapping sections.
Step 2: Assign every question to an owner
Security questionnaires cross departments. Engineering knows about access and encryption, People Ops about background checks and training, Legal about subprocessors and contracts. Give each question a single owner and a due date that leaves time for review.
Step 3: Start from answers you have already reviewed
Most questions have been asked before. Reuse previously approved answers as a starting point, then check whether anything changed since they were reviewed. An old answer that is no longer true is worse than no answer.
Step 4: Tie each answer to evidence
For every “Yes”, identify the record that supports it: the policy section, the access review, the configuration screenshot, the training record. If you cannot find support, the honest answer is often “Partially” with an explanation, or “No, planned for” with a date. Customers generally respond better to a clear, accurate gap than to a claim that falls apart in a follow-up call.
Step 5: Write short, specific answers
- Answer the question that was asked, in the first sentence.
- Be specific: “Production access requires SSO with MFA and is reviewed quarterly” beats “We follow industry best practices.”
- Avoid absolute promises such as “never” or “100%” unless they are literally true.
- Do not attach confidential documents unless the customer is under NDA and actually asked for them.
Step 6: Review before it leaves your team
A named person should approve the final response. Record who reviewed each answer and which version of the evidence they looked at. When a customer asks a follow-up six months later, you will know where the answer came from.
Step 7: Keep the answers for next time
Save the reviewed answers and their sources in one place. When a policy or control changes, flag the answers that depend on it. That is what turns the tenth questionnaire into a day’s work instead of a week’s.
Common mistakes
- Copying answers from a previous questionnaire without checking they are still accurate.
- Letting sales fill in technical answers without engineering review.
- Answering “Yes” to a control you only partly operate.
- Losing track of which answers were sent to which customer.
Short on time?
Send us the questionnaire and we answer it in 1–3 working days for a fixed CHF 490: every answer checked against your documents, gaps marked honestly, delivered in your customer’s own file. See how it works.
Published 2 October 2026 by ControlQuay. General information, not legal or audit advice.