Regulation and sustainability
Client security questionnaires
A large client sends a hundred questions about how you handle their information. How to answer without dying trying.
A questionnaire arrives from a large client with dozens or hundreds of questions about how you store their information, who accesses it and what would happen if something failed. Frameworks such as ISO 27001, NIS2 or the GDPR appear by name, and the typical reaction — answering fast so as not to stall the contract — is what gets paid for later.
The four blocks that repeat
| Block | What they ask | What answers it |
|---|---|---|
| Who has access | How access is granted and removed | Your policy and the activity log |
| Where the data is | Location, providers, subprocessors | The list of who you use and for what |
| What happens if something fails | Backups, recovery, incident notification | Your plan, however short |
| And what certifications you hold | Current certificates and their scope | The certificate, with its scope and date |
Important
The second half of that last row sinks many companies: holding a certificate is not enough, you must state **what it covers**. A certificate covering one site or one service, presented as if it covered the whole company, is spotted on first review and costs credibility for everything else.
How to answer without redoing the work each time
- 1
Keep the answers you gave, not only the questionnaire
80% of questions repeat between clients; answering from scratch each time is the expensive mistake.
- 2
With the date of each answer
What was true two years ago may not be; an undated answer gets copied and ages by itself.
- 3
With who validated it
Technical answers are validated by whoever knows, not by whoever fills in the form.
- 4
And without promising what you do not do
Ticking "yes" for something you have not built becomes a contractual breach the day it is checked.
Watch out
The fourth point causes the most trouble and is done most often without noticing. One extra "yes" in a questionnaire is not sales optimism: it becomes part of what you have declared to that client, and if there is ever an incident, your answer is compared with reality.
What is up to you even without certifications
Those four are answered with what you already do, provided it is recorded, and they weigh most in the assessment of a small company — more than holding a badge.
Worth knowing
Which frameworks apply, their deadlines and who they bind vary by country, sector and size, and they move. What is described here is how to organise the answer; **what applies to you and from when is a question for your adviser**, not something to infer from a questionnaire.
›Do we need certification to sell to a large company?
Not always; many accept answers and evidence without a certificate. Ask before investing.
›Can I reuse answers from another client?
Yes, and it is sensible; what does not work is reusing them without checking the date.
›What if an answer is "we do not have that"?
It is a valid answer, especially if you say what you do instead. Lying is not.
A real case
The situation
A small firm receives a security questionnaire from a large client and fills it in one afternoon.
What you do
- Keeps the answers with dates and who validated them
- Corrects two "yes" answers that matched nothing in place
What you get
The next questionnaire takes two hours and declares nothing they cannot stand behind.
The situation
A hundred questions and two weeks.
What you do
- Starts from the previous questionnaire's answers
What you get
You begin from something rather than zero.
The situation
Yes is answered to something that cannot be backed up.
What you do
- Links each answer to its document
What you get
You answer what can be evidenced.
The situation
The always-attached documents are scattered.
What you do
- Gathers the company file in one place
What you get
Attaching stops being half the job.
The situation
Gaps are spotted and forgotten on submission.
What you do
- Notes what was missing as the year's agenda
What you get
The next questionnaire finds fewer gaps.
The situation
Each client asks the same on a different form.
What you do
- Reuses the same documentary base
What you get
The third questionnaire costs an afternoon.
This article answers
- client security questionnaire
- they are asking for iso 27001
- answering a supplier security assessment
- vendor risk assessment questions