How to answer a client security questionnaire honestly
A larger customer has sent a security questionnaire and a deadline. We help you answer accurately, gather the evidence behind each answer and avoid ticking anything you cannot stand behind.
Who this is for
For the founder, sales lead or operations person who has just been handed a spreadsheet of security questions by a prospective customer. The contract may hinge on it. You are not sure what counts as a yes, and you would rather lose a point than lose your credibility.
Why these questionnaires cause so much grief
Forty questions, one week
The deadline is tight, the wording is aimed at huge suppliers, and nobody in your team knows what a vulnerability management policy is. The deal sits waiting while you search.
The urge to tick everything
Marking yes on a control you only half have feels harmless in the moment. Later it sits inside a signed contract, and an audit or a breach turns it into a serious problem.
Answers that differ each time
Last month's questionnaire said one thing, this month's says another, written by whoever was around. Buyers compare notes, and inconsistency looks like carelessness.
Nothing to attach as proof
Buyers rarely stop at yes. They ask for a policy, a screenshot of settings or a backup record. If none exists, even a true answer looks thin.
Honest answers, with the evidence ready
Scope &
Strategy
We read the questionnaire with you, sort each question into yes, partly or no, and agree the wording. We also work out which gaps are worth closing before the next buyer asks the same thing.
About Scope & StrategySystems &
Solutions
We build a reusable answer bank and a small evidence folder of policies, settings, access lists and backup records. The next questionnaire becomes an afternoon of checking rather than a week of panic.
About Systems & SolutionsSecurity &
Support
We keep the bank honest as things change, retire answers that stop being true and close gaps in the order buyers ask about them. We follow the Cyber Essentials controls ourselves and describe that exactly as it is.
About Security & SupportQuestions people ask
How do I answer a supplier security questionnaire as a small business?
Answer only what is true today. Say partly when it is partly, and add a date for any fix you have actually planned. Attach evidence where you can. Ask the buyer which answers matter most, since many accept a plain, honest picture from a small supplier.
Do I need Cyber Essentials to win larger contracts?
Sometimes. Some buyers, particularly in the public sector, require it, while many private customers only want to know you follow the controls. Check each tender or ask the buyer directly. Never claim a status you do not hold, because that is worse than having none.
What if I have to answer no to a security question?
A no with a plan is usually safer than a yes you cannot back. Say what you do instead, what you are changing and by when. Buyers often care more about honesty and direction than a flawless score, especially from a small supplier.
How can NYAS help with a questionnaire I have been sent?
Start with a conversation, ideally before you reply to the buyer. Share the questions and tell us what you actually have in place. We will help you decide what to say, what to fix first, and what evidence to pull together.
Talk to us about answering client security questions.
You tell us what is going on. We tell you honestly whether we can help, and if we cannot, we will say so.