Security questionnaires: why customers ask and how to answer well
Why customers send security questionnaires, which frameworks sit behind the questions and how to answer honestly, with evidence, in less time.
In this topic: IT and data 18
A security questionnaire rarely arrives on its own. It comes with a contract renewal, a tender or a new customer's onboarding pack, and the account manager wants it back by Friday. The questions look technical, but most of them ask one thing in many ways: can this supplier be trusted with our data and our operations? The answers, meanwhile, are spread across the IT partner, a few policies and the memory of one colleague.
Customers do not ask out of curiosity. Laws, insurers and auditors hold them responsible for the risks their suppliers bring in. Once you know which duty and which framework sit behind the questions, you can answer faster and more convincingly, and do the hard work only once.
Customers send security questionnaires because laws, insurers and auditors hold them responsible for their suppliers' security. The questions come from a handful of frameworks and keep returning to the same eight areas. Answer honestly, back each answer with evidence, mark gaps as planned with a date, and keep approved answers in one library with one owner.
- Customer duties
- Frameworks
- Evidence
- Answer library
Why customers send security questionnaires
Your customer is usually passing on a duty of its own. Knowing which one tells you which answers matter most.
A questionnaire is the visible end of a chain. A law, an insurer or an auditor holds your customer responsible for the risks its suppliers bring in, and the customer passes that duty on as questions, contract clauses and sometimes audit rights.
Part of your answer depends on your own suppliers, such as your cloud host or IT partner. And a buyer who asks for your last restore test is not doubting you personally: it has to show its regulator, insurer or board that it checked.
| Driver | The customer's duty | What you can expect |
|---|---|---|
| NIS2 (EU) | Medium-sized and large organisations in critical sectors must manage cybersecurity risk (source: European Commission, July 2026), and supply chain security is one of ten key elements (source: European Commission, June 2023). | Questions on access, incidents and how fast you would warn them. |
| DORA (EU finance) | Since 17 January 2025, financial entities must manage ICT third-party risk and keep a register of their contracts with ICT service providers (source: EBA, April 2025). | Detailed questions plus contract clauses. |
| GDPR (EU) | Customers may only use processors that give sufficient guarantees, and processors must allow for and contribute to audits, including inspections (source: EUR-Lex, April 2016). | Privacy questions, a processing agreement and a list of your subprocessorsSubprocessorA supplier of yours that handles your customer's personal data on your behalf, such as a cloud host or an email service.. |
| Insurers | Cover may depend on information about your security controls, and if you claim measures that are not in place, the insurer may not be obliged to pay (source: UK NCSC, August 2020). | The same questions from your own insurer. Keep the answers consistent. |
| Public buyers | UK central government requires Cyber Essentials, or equivalent controls, for higher-risk contracts, such as those where ICT systems and services are supplied (source: GOV.UK, February 2025). | A certificate, or proof of equivalent controls, when you bid. |
| US customers | Customers and business partners often request a SOC 2 report from a service organisation (source: AICPA, October 2022). | That report, or an explanation of what you offer instead. |
These rules keep moving. EU countries had until 17 October 2024 to write NIS2 into national law (source: European Commission, July 2026), so details differ by country, and amendments proposed in January 2026 were still before the European Parliament as of November 2026 (source: European Parliament, November 2026).
The frameworks behind the questions: ISO 27001, SOC 2 and more
Behind most questionnaires sits one of a handful of frameworks. Each comes from a different place and produces a different kind of proof.
| Framework | What it is | Proof you can show |
|---|---|---|
| ISO/IEC 27001 | The world's best-known standard for an information security management systemISMSInformation security management system: the policies, roles, risk assessments and regular reviews an organisation uses to manage security and keep improving it.; certification is optional, and ISO itself does not certify (source: ISO, November 2026). | A certificate whose scope should cover the service your customer buys. |
| SOC 2 | An examination by certified public accountants of a service organisation's system description and controls for security, availability, processing integrity, confidentiality or privacy (source: AICPA, October 2022). | A report, often shared only under a non-disclosure agreement. |
| Cyber Essentials (UK) | The minimum standard the UK government recommends for organisations of all sizes, built on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection (source: UK NCSC, November 2026). | A certificate; the Plus level adds independent technical testing (source: UK NCSC, November 2026). |
| NIST CSF 2.0 (US) | A framework for managing cybersecurity risk in any sector or type of organisation, with six functions: Govern, Identify, Protect, Detect, Respond and Recover (source: NIST, February 2024). | A self-assessment of how your measures cover each function. |
| CSA CAIQ (cloud) | The Cloud Security Alliance's yes or no questions to assess cloud providers, combined with its Cloud Controls Matrix of 197 control objectives in 17 domains (source: Cloud Security Alliance, November 2026). | A completed questionnaire, which providers can submit to the STAR Registry (source: Cloud Security Alliance, November 2026). |
The frameworks overlap heavily. Access, updates, backups and incident handling come back in all of them, in different words and at different depth, so one well-kept set of answers can serve most questionnaires.
What security questionnaires ask about
However long the list, it usually comes down to eight areas. Prepare those once and the next questionnaire becomes a matter of matching and checking.
Questionnaires differ in length and wording far more than in substance. A short web form and a long spreadsheet ask about the same areas, and a question that looks new is usually an old one in other words. Questions on updates, training and testing tend to sit under governance or access.
- Governance: an owner for security, policies approved by management, a yearly review.
- Access: who can reach what, multi-factor authenticationMulti-factor authentication (MFA)Signing in with a password plus a second proof, such as a code or prompt on a phone, a security key or a fingerprint. on every account, leavers removed the same day.
- Encryption: devices encrypted, data protected in transit and at rest.
- Backups: how often, a copy out of reach of your network, the last restore test.
- Continuity: how long the service may be down, and when the recovery plan was tested.
- Incidents: a written plan, and how quickly you will tell the customer.
- Suppliers: who touches customer data, what you require of them, how you check.
- Privacy: which personal data, where it is stored, the processing agreement.
The measures behind these areas, from sign-in to backups, are explained in the IT and data guides.
How to answer a security questionnaire well
A good answer is short, true and backed by something the customer can check. An honest "planned" does less damage than a yes you cannot prove.
Every answer rests on three layers. The policy says what you commit to, the procedure says who does it and when, and the evidence shows that it happened.
Take sign-in. "Every account requires a second step, set up by IT when the account is created" is policy and procedure. An admin export showing every account enrolled is the evidence. Evidence is what ends the follow-up questions, so prepare from the bottom up.
- 1Read the scope firstWhich service, data and locations? Answer for that scope and say so.
- 2Start from approved answersCopy from the library and adjust to the exact question. Answer what is asked, no more.
- 3Point to evidenceName the document, its date and its owner. Share sensitive material, such as a penetration testPenetration testA controlled attack on your systems by specialists, with your permission, to find weaknesses before criminals do. report, only under a non-disclosure agreement.
- 4Mark gaps as planned, with a date"Planned, in place by (month)" is credible. A false yes can cost the contract, and with an insurer a claim may not be paid (source: UK NCSC, August 2020).
- 5One owner signs offOne person checks every answer before it leaves. Sales may chase, but does not answer.
- 6Feed the libraryNew questions and approved answers go back in, with the date and the evidence used.
An answer library and a trust page
The second questionnaire should take a fraction of the time of the first. That only happens when answers and evidence live in one place, with one owner.
Answer library
Standard questions, approved answers, evidence and the date of the last check, sorted by the eight areas. One owner keeps it current.
Trust page
Your certificates, a short security and privacy summary, your subprocessors and a security contact, on your website. Detailed reports go out on request.
Evidence folder
Current versions of everything you attach, each with an expiry date, so nobody sends last year's certificate.
The owner is often the managing director or IT lead in a company of a few dozen people, and the security or compliance function in a group. Review the answers at least yearly and after every major change, such as a new cloud provider or an incident. When something changes that a customer relies on, tell them before their next questionnaire does.
When a security certification pays off
A certificate does not replace good answers, but it can replace a lot of questions. Whether it pays off depends on who your customers are.
| Your situation | What usually helps | Why |
|---|---|---|
| UK central government work with higher cyber risk | Cyber Essentials, or Plus if required | Required unless you show equivalent controls (source: GOV.UK, February 2025). |
| Software or services for US companies | A SOC 2 report | Often requested by customers and partners (source: AICPA, October 2022). |
| European enterprise or public customers | ISO/IEC 27001 certification | Organisations certify to reassure customers and clients (source: ISO, November 2026). |
| A cloud service | A CAIQ in the STAR Registry | One self-assessment to share with every buyer (source: Cloud Security Alliance, November 2026). |
| Rare, light questionnaires | A strong answer library and trust page | Certification costs time and money every year. |
Three signals that the time has come: the same questions keep returning, deals stall at procurement, or tenders demand a certificate. Whatever you choose, make sure its scope includes the service your customer buys, and check scope and date before you rely on a supplier's certificate yourself.
Are you ready for the next security questionnaire?
Answer for your own organisation and see where to start.
- 1We know which customers fall under rules such as NIS2, DORA or the GDPR, and what they need from us.
- 2We know which framework each main customer bases its questions on.
- 3Every account, including administrator accounts, signs in with a second step.
- 4We restored data from a backup in the last twelve months and recorded the test.
- 5Every answer we send can be backed by a document, report or record.
- 6One named person approves every questionnaire before it goes out.
- 7Approved answers and evidence sit in one library, reviewed at least once a year.
- 8We have decided, based on our customers, whether a certificate is worth it.
Related guides
Answer library outline and evidence checklist
Below you will find an answer library outline with common questions, model answers and evidence, an evidence checklist with refresh and sharing rules, and a final check before sending.
Frequently asked questions
Can we refuse to fill in a customer's security questionnaire?
Should we share our penetration test report or our full policies?
Does an ISO 27001 certificate mean we comply with NIS2?
Our IT partner manages everything. Can we simply forward the questionnaire?
- European Commission: NIS2 Directive, frequently asked questions (June 2023)
- EBA: Preparations for reporting of DORA registers of information (April 2025)
- GOV.UK: PPN 014, Cyber Essentials scheme (February 2025)
- NIST: NIST releases version 2.0 of landmark Cybersecurity Framework (February 2024)
- ISO: ISO/IEC 27001, Information security management systems (November 2026)
- UK NCSC: Cyber insurance guidance (August 2020)