Blog · Security questionnaires · Problem 1 of 93
A customer sent a security questionnaire. Answer it by Friday, honestly.
· 4 min read · By Case Jones
You run engineering or the company, and a buyer just sent a spreadsheet with 150 security questions. The deal is waiting on it, and nobody on the team has done one before.
What it costs to leave it
A late or vague questionnaire tells the buyer your security is an afterthought, and the deal slows down or goes quiet. An answer that claims more than you do is worse. It can end up in the contract, and the buyer will ask for proof later.
How to answer it this week without making things up
Most questionnaires look bigger than they are. Many questions repeat each other, and a good share have short, true answers you already know.
- 1
Read the whole thing once before answering anything
Skim every question and mark each one with a color. Green means you do it and can say how. Yellow means you sort of do it, or one person does it by habit. Red means you do not do it at all. This takes an hour and tells you where the week will go.
- 2
Group the repeats
Questionnaires like SIG Lite, CAIQ and custom vendor forms ask about the same few areas several times in different words. Access control, encryption, backups, incident response, vendor management and employee onboarding come up again and again. Write one good answer per area and reuse it, so your answers agree with each other.
- 3
Answer the greens in plain sentences
Say what you do, who does it, and which tool does it. "All production databases are encrypted at rest using AWS KMS" is better than "We follow industry best practices." Reviewers skip the vague answers and slow down on the specific ones, in a good way.
- 4
Be straight about the yellows and reds
For a red, say No and add one line on what you do instead, or when you plan to do it. Reviewers expect a small company to have gaps. What worries them is an answer that sounds polished and turns out to be false. If you commit to a date, pick one you will actually meet.
- 5
Ask what they need when a question does not fit
Some questions assume a data center, a security team or a certification you do not have. Mark them as not applicable and say why in a few words. If you are unsure what they mean, email the contact and ask. Buyers would rather answer a question than read a guess.
- 6
Keep your answers for next time
Save the final answers in one place with the date and who wrote them. The next questionnaire will ask most of the same things. The yellows and reds are also a ready-made list of the policies and practices to work on first.
Example
A sample answer to a yellow
Question: Do you perform quarterly user access reviews? Answer: Partially. We remove access the day someone leaves, using a checklist owned by our CTO. We have not yet run formal quarterly reviews. We will run the first one by March 31 and keep the sign-off as a record.
Or let 93 Compliance do the sorting
Paste or upload the questionnaire, as a spreadsheet or a document. Each question becomes a requirement, and a test marks every one green, yellow or red against your policies and risks. You see what you have, what is thin and what is missing before you write a word.
Answers can be drafted, kept and edited, and the questionnaire exported back in its own format. The check also compares what your website claims with what your policies say, so the questionnaire and your site do not contradict each other.
The red and yellow answers point straight at the policies to write next, and the policy builder can start them for you. All of this is free, with no card.
- Every question marked green, yellow or red
- Drafted answers you can edit and keep
- The questionnaire exported back for the customer
- Website claims compared with your policies
Check my questionnaire
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
Can I say no on a security questionnaire?
Yes. A clear No with a short note on what you do instead is a normal answer, and reviewers see them all the time. A yes you cannot back up is the real risk, because buyers often ask for evidence or write the answers into the contract.
How long should each answer be?
One to three sentences is usually right. Say what you do, who does it and with which tool. Long paragraphs tend to hide the answer, and reviewers notice.
Should I attach our policies?
Only if they ask, and only if the policies are real and current. Many companies share policies under an NDA or offer a summary instead. A policy that describes things you do not do creates more questions than it answers.
What if we have no policies at all yet?
Answer what you can about how you actually work, and be honest that written policies are in progress. Then write the core ones soon, because the next buyer will ask for them.