How to answer a client security questionnaire (without overclaiming)

By Akash Sengar · 6 October 2026 · 6 min read

Why clients send questionnaires

Larger clients must manage the risk of every supplier that touches their data or systems. A vendor security assessment questionnaire is how they do it: a list of questions about your policies, access control, encryption, backups, incident response and more. For a small IT or services company, one questionnaire can decide whether you win the contract.

Common formats

• SIG and SIG Lite: the Standardized Information Gathering questionnaire from Shared Assessments, used widely in financial services. SIG Lite is the shorter version for lower-risk suppliers.
• CAIQ: the Consensus Assessments Initiative Questionnaire from the Cloud Security Alliance, aligned with its Cloud Controls Matrix and used for cloud and SaaS providers.
• Custom spreadsheets: the most common format in practice, often a few hundred rows mixing yes/no questions, free text and requests for evidence.
• Portals: some clients use a third-party risk platform where you answer online and upload documents.

Before you answer

1. Read the whole questionnaire first and note which questions need evidence, not just a yes.
2. Ask the client what scope they mean: your whole company, or only the service and data they are buying.
3. Agree a realistic deadline. A rushed answer full of "yes" is worse than a slightly later honest one.
4. Assign one owner, with input from IT, HR, legal and leadership.

Build an evidence library

Most questionnaires ask the same things in different words. Keep a library you reuse:

• Information security policy, acceptable use, access control, backup and incident response policies, each approved and dated.
• An asset inventory and a list of subprocessors and where data is hosted.
• Screenshots or exports showing MFA enforcement, device encryption, patching and backup success.
• Your latest penetration test executive summary and remediation status.
• Training records, background check process and joiner-mover-leaver steps.
• Certificates or reports you hold, such as ISO 27001 or SOC 2, with their scope.

Keep a master answer sheet with your standard wording for each topic, the evidence file name and the date it was last checked.

How to answer a security questionnaire honestly

Overclaiming is the biggest risk. Your answers often become part of the contract, and a client may audit them later. Use the full range of answers:

• Yes: only when the control is in place everywhere in scope and you can show evidence.
• Partially: when it covers some systems or people. Say which, and when the rest will be done.
• No, with a compensating control: for example "We do not run a SIEM. Microsoft 365 and firewall alerts go to a monitored mailbox and are reviewed daily."
• Not applicable: with a one-line reason, such as "We do not store card data."
• Planned: with a date you are confident of.

Clients generally prefer a clear "partially, completing by March" to a "yes" that falls apart at the first follow-up question.

A repeatable process

1. Log every questionnaire received: client, deadline, format and owner.
2. Answer from your master sheet first, then fill gaps with the right people.
3. Have someone senior review the answers for accuracy before they go out. Treat it like a contract.
4. Attach only the evidence asked for, and share sensitive documents such as penetration test reports under NDA or through a secure portal.
5. Record follow-up questions and commitments you made, with dates.
6. Update the master sheet and evidence library with anything new.

After a few questionnaires, the master sheet answers most questions and each new one takes far less time.

Turning gaps into a plan

Questionnaires are a free gap assessment written by your customers. Group the "no" and "partially" answers by theme, such as identity, devices, logging, suppliers and continuity, and turn them into a short security roadmap with owners and dates. Fixing multi-factor authentication, device encryption, backups with restore tests, and a written incident response plan usually closes many questions at once. Share the roadmap with clients who ask; it shows a supplier that knows its gaps and is closing them.

Writing answers clients trust

Good answers are short, specific and checkable. Compare "We take security very seriously and follow industry best practices" with "MFA is enforced for all Microsoft 365 users through Conditional Access; evidence: policy screenshot, 1 October." The second answers the question, names the control and points to evidence. A few rules help:

• Answer the question asked, in one to three sentences.
• Name the tool or process, the scope and how often it runs.
• Avoid absolute words such as "all", "always" and "never" unless they are literally true.
• Do not paste policy text as an answer; summarise it and attach the policy.
• Where a control belongs to a provider, such as Microsoft or AWS, say so and point to their published reports.

Using AI or templates to answer

Templates and AI tools can speed up drafting, but every answer must still be checked against what you actually do. A generated answer that describes controls you do not have is overclaiming, and it is your company that signs the response.

Questions that trip companies up

• "Do you encrypt data at rest?" Check every location: laptops, servers, backups, SaaS tools.
• "Do you perform annual penetration testing?" Say what was tested and when, not just yes.
• "Do you have a business continuity plan, and is it tested?" A plan never tested is a partial answer.
• "Do you notify us of incidents within 24 hours?" Make sure you can, and that it fits your CERT-In 6-hour duty.
• "Do subprocessors meet the same standards?" You need a list and some evidence of checks.

If a client pushes back on an answer, ask what risk they are worried about. Often a compensating control, a short call with your technical lead or a dated commitment in the contract settles it. Keep notes of what was agreed so the next questionnaire from the same client starts from there.

When ISO 27001 or a SOC 2 report saves time

If you answer several questionnaires a year, a recognised certification or report can shorten them. Many clients accept an ISO/IEC 27001 certificate with its Statement of Applicability, or a SOC 2 Type 2 report, in place of large sections of their questionnaire. Neither removes questionnaires completely, and the certificate's scope must cover the service the client buys. Our ISO 27001 or SOC 2 guide explains which one your clients are more likely to expect.

Getting security questionnaire help

IT and ITES companies selling to banks, insurers and overseas clients face these most often; our IT and ITES page covers that context. If questionnaires keep landing on a founder's desk, a virtual CISO can own the evidence library, answer with you and close the gaps they reveal.