Blog · Security questionnaires · Problem 4 of 93
Every customer asks the same 200 security questions, in a new spreadsheet.
· 2 min read · By Case Jones
You have answered three or four questionnaires this year. Each one arrives in a different format, with the same questions worded differently, and someone spends two days copying from the last one and hoping it still holds.
What it costs to leave it
The copying is not the real cost. Answers drift: one questionnaire says backups are daily, the next says weekly, and a careful buyer notices. Every questionnaire also pulls your most senior engineer off real work for days.
How to answer once and reuse it safely
Under the different wording, most questionnaires cover the same dozen areas. Organize your answers by area, not by spreadsheet.
- 1
Collect every questionnaire you have answered
Put them side by side. Where two say different things about the same practice, find out which is true today. Fix that first; contradictions are what reviewers catch.
- 2
Sort the questions into areas
Access control, encryption, backups and recovery, incident response, vendors, HR and onboarding, change management, physical security, privacy. Most questions fall into about a dozen areas like these.
- 3
Write one answer per area, then short variants
Write a full answer for each area that names what you do, who does it and with which tool. Then cut it down to the yes/no and one-sentence versions that spreadsheets ask for. Variants of one answer cannot contradict each other.
- 4
Point each answer at a policy
Each answer should be backed by a written policy or procedure. If none exists, the answer is resting on memory, and that policy is your next one to write.
- 5
Date the answers and review them twice a year
Practices change. A dated answer bank with an owner, reviewed every six months, stays true. An undated one becomes last year’s questionnaire in a new font.
Example
One answer, three lengths
Full: “Production data is backed up daily by AWS Backup and kept for 35 days. A restore is tested each quarter by the on-call engineer and recorded.” Short: “Daily backups, 35-day retention, quarterly restore tests.” Yes/no: “Yes.”
Or let your policies answer the questions
Paste or upload each questionnaire as it arrives, in its own format. Every question becomes a requirement, and a test marks it green, yellow or red against your policies and risks. You only work on the yellows and reds.
Answers can be drafted, kept and edited, and the questionnaire exported back in the format the customer sent. Because the answers come from your policies, two questionnaires answered a month apart say the same thing.
The check also compares what your website claims with what your policies say, so the site and the spreadsheet agree. It is free, with no card.
- Any spreadsheet or document format
- Every question checked against your policies
- Answers drafted, kept and exported back
- Website claims compared with your policies
Check a questionnaire
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
Can we send our own standard answers instead of their spreadsheet?
Some buyers accept a standard document such as a SIG Lite or CAIQ, or a security overview. Many still need their own form filled in for procurement. Offer yours first; fill in theirs if they insist.
Why do the questions keep changing wording?
Each buyer adapts a standard list, and often adds questions after a past incident. The wording changes; the topics rarely do.
Who should own the answer bank?
One person, usually whoever owns security, with each area checked by the person who runs it. The owner keeps the dates and decides when an answer changes.