Answer the questionnaire from evidence you already have, not from what you wish were true. Pull the request apart by topic (identity, encryption, backups, incident response, subprocessors, physical access), match each topic to a document or configuration screen already in your environment, and write every honest gap as a plain compensating practice rather than leaving it blank or inventing a control you do not run. A small company with no security team can turn most questionnaires around in a few hours once it has a reusable answer set, and the process below builds that set once so the next one takes an afternoon instead of a week.
What the questionnaire is actually testing
A customer’s security questionnaire is not a pop quiz. It is the visible output of the customer’s own supplier risk program, and it is asking you to do their homework for them. The NIST Cybersecurity Framework (CSF) 2.0, published February 26, 2024, puts this under the GOVERN Function’s Cybersecurity Supply Chain Risk Management category (GV.SC). GV.SC-04 requires that an organization knows its suppliers and prioritizes them by criticality, and GV.SC-06 requires due-diligence planning before a formal relationship begins. The questionnaire sitting in your inbox is literally how a larger customer’s security team satisfies those two outcomes: they decided you are a supplier worth asking about, and they are doing the pre-engagement diligence the framework expects of them.
If your customer is a bank, a credit union, or another financial institution, there is a sharper reason behind the questions. The FTC Safeguards Rule at 16 CFR 314.4(f) requires covered financial institutions to select service providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess providers based on the risk they present. That rule is not optional for your customer, so the questionnaire is not optional for them either. It is rarely personal skepticism about your company and almost never a negotiating tactic; it is paperwork their own regulator or insurer expects them to keep on file.
Decode the format before you panic
Most of the anxiety around these requests comes from the format, not the content. Four shapes cover nearly everything you will receive.
| Format | What it looks like | How to treat it |
|---|---|---|
| Custom spreadsheet or Word form | A one-off list of yes/no and free-text questions written by the customer’s procurement or security team | Answer it directly; it usually maps cleanly onto your evidence-to-answer table below |
| A standardized question set | A long, numbered questionnaire such as the Shared Assessments Standardized Information Gathering (SIG) questionnaire, or the Cloud Security Alliance’s Consensus Assessments Initiative Questionnaire (CAIQ) | Answer only the subset the customer actually scoped in, which is usually a fraction of the full question library; do not try to complete the whole thing from memory |
| A vendor-risk portal | A third-party platform (Whistic, OneTrust, Vanta’s trust pages, and similar tools are common) that asks you to log in and fill out fields online, or to upload a completed attestation | Build your answers once in your own document first, then paste them in; never improvise fresh language inside someone else’s portal under time pressure |
| A document request only | “Please send your SOC 2 report, ISO 27001 certificate, or security policy” with no question form | If you have one of those, send it with a one-line scope note; if you do not, say so plainly and offer the evidence you do have instead |
These standardized libraries exist because enterprise buyers got tired of writing custom forms, and a numbered question in one customer’s SIG or CAIQ packet maps to the same underlying control every time. Once you answer one honestly, keep it; it will reappear almost verbatim from the next customer using the same library.
The evidence-to-answer map
This is the part that turns a questionnaire from a research project into a lookup exercise. Most of what a customer asks about already exists somewhere in a small company’s environment, even without a dedicated security hire. The work is matching the question to the evidence, not creating the evidence from scratch.
| Question topic | Where the evidence already lives for most small companies | Honest answer if the control is partial or missing |
|---|---|---|
| Identity and access (MFA, password policy, offboarding) | Your identity provider’s admin console (Microsoft 365, Google Workspace, or Okta) shows MFA coverage and conditional access rules directly | “MFA is enforced for [population]; we are extending coverage to [remaining population] by [date]” |
| Encryption in transit and at rest | Most SaaS platforms and cloud providers enable this by default; check the provider’s own trust or security page rather than guessing | “Encryption in transit and at rest is provided by [platform] as a default configuration; we have verified it is enabled, not assumed it” |
| Backup and recovery | Your backup tool’s dashboard, plus the date of your last tested restore | “Backups run on [schedule]; our last tested restore was on [date]” is a stronger answer than a bare “yes” with no date |
| Incident response | A short written plan naming who gets called and in what order; see our incident response planning without a security team guide if this does not exist yet | “We have a documented incident response plan last reviewed on [date]; we do not operate our own 24/7 monitoring and rely on [provider] for that function” |
| Subprocessors and fourth parties | Your own vendor list: which cloud host, email provider, and payment processor touch the customer’s data | List them by name and function rather than a vague “various cloud providers” |
| Employee screening and security training | HR onboarding records and whatever awareness training you actually run, even a short annual module | State the real cadence; a thin but real program beats a confident claim with nothing behind it |
| Physical access to offices or data centers | Your cloud provider’s own attestations cover the data center; your office covers badge or lock-and-key access to local equipment | Separate the two: “Customer data is hosted at [provider]’s facilities, which publish their own attestations; our office access is controlled by [mechanism]” |
Build this table once as a living document, not a one-time export. Every new questionnaire becomes an exercise in copying rows out of it, updating the few that changed, and writing fresh prose only for questions nobody has asked before.
When the honest answer is “we don’t have that control”
The instinct to round up is the single most common mistake in questionnaire responses, and the one that does the most damage later. Claiming a SOC 2 report you do not have, a dedicated security team you do not employ, or 24/7 monitoring you do not run creates a contractual representation that can resurface during a breach investigation or a renewal audit, at the worst possible moment.
The better answer names the gap and the compensating practice in the same sentence. “We do not operate continuous monitoring internally; [named provider] monitors our infrastructure and alerts our team” is a complete, defensible answer. “We do not yet have a formal data retention policy; data is deleted from [system] after [period] as a matter of practice, and a written policy is in progress” is honest and still moves the sale forward in most cases. Reviewers at mid-sized and larger customers see incomplete security programs constantly; what stalls a deal is evasiveness, not an honest gap with a stated plan.
When a one-off response stops being enough
A spreadsheet answer bank works until it does not. Three signals say it is time to invest in something more formal: the same large customers keep sending deeper questionnaires every renewal cycle, a prospect’s security team starts asking for evidence rather than attestations (screenshots, exports, a call with whoever owns the control), or you are quoting the same answers often enough that a SOC 2 report or an ISO/IEC 27001:2022 certification would replace a dozen individual cycles with one reusable artifact. SOC 2 is an attestation report issued by a licensed CPA firm under American Institute of Certified Public Accountants (AICPA) standards, not a certification; ISO/IEC 27001:2022 is a certification issued by an accredited certification body. Neither comes from a consultancy, and neither replaces the honest answer-bank work above.
That is the point at which a fixed-fee compliance readiness review earns its cost: mapping your controls against the framework a customer or industry keeps asking about, closing the gaps that are cheap to close, and documenting the rest as a roadmap rather than a surprise. DSE’s small-business security posture and compliance readiness work is built for exactly this stage, a company that has outgrown ad hoc answers but does not have, and may not need, a full-time security hire yet.
If you are evaluating a vendor’s answers rather than writing your own, the process runs in reverse; see our vendor security review checklist for SaaS buyers for the buyer-side version of this same diligence cycle.
Georgia and metro Atlanta companies facing their first enterprise questionnaire from a larger customer, especially one in financial services or healthcare, often find the fastest path is a scored read of their current posture before the next renewal cycle forces the question; see the fractional CISO and vCISO work for Atlanta and Georgia small businesses for that starting point.
Questions buyers ask
Do we need a penetration test to answer a security questionnaire?
Usually not for a first response. Most questionnaires ask whether you test your systems, not for a specific test to already be complete. If a customer requires a penetration test as a contract condition, scope it separately; DSE performs LLM application, external network and web application, and cloud configuration and identity testing, not internal network or assumed-breach testing, so match the request to the right test before quoting one. See penetration test vs vulnerability scan for the distinction a questionnaire usually means.
What if we genuinely have no written security policies at all?
Say so, and write the shortest version that is actually true: who can access what, how backups run, who gets called if something breaks. A one-page policy set answers more fields than most companies expect, and it is faster to write than to keep explaining its absence every cycle.
Should sales or the founder answer the questionnaire, or should we hire this out?
Whoever answers it needs direct knowledge of the controls, not just confidence filling out forms. A founder or operations lead who runs the identity provider and the backup tool can usually answer most topics correctly; what breaks is a salesperson guessing at technical rows to close the deal faster. Route anything uncertain to whoever actually configured the system, even if that takes an extra day.
Can we reuse answers across different customers’ questionnaires?
Yes, and you should. The underlying controls do not change between customers; only the question format does. Maintain the evidence-to-answer table as your source of truth and translate it into whatever form each customer uses. Resist editing the underlying facts to sound better for a specific deal; the answer should be the same regardless of who is asking.
Does completing a questionnaire make us compliant with anything?
No. A completed questionnaire is a disclosure, not a certification, an audit, or a guarantee of any compliance, insurance, or legal outcome. It tells the customer what you actually do today. Whether that is sufficient for their regulatory or contractual obligations is their determination to make, informed by what you disclosed, not a status you can claim on your own.
What this guide is / What it is not
What it is: A practitioner process for answering an incoming customer security questionnaire without a dedicated security team, anchored to NIST CSF 2.0 GOVERN subcategories GV.SC-04 and GV.SC-06 (NIST CSWP 29, February 26, 2024) and the FTC Safeguards Rule at 16 CFR 314.4(f). What it is not: Legal advice, an audit, a certification, or a guarantee of any compliance, insurance, or contractual outcome. DSE prepares organizations to answer these requests credibly and does not certify, attest to, or guarantee the accuracy of any vendor’s questionnaire response; that representation remains the responding organization’s own.
The Bottom Line
Treat every incoming questionnaire as a lookup against evidence you already have, not a fresh research project, and the second one takes a fraction of the time the first one did. Build the evidence-to-answer table once, write every real gap as a named compensating practice instead of a confident guess, and route technical rows to whoever actually runs the system. When the same large customers keep asking deeper questions every renewal, or a prospect starts requesting proof instead of promises, that is the signal to move from a one-off answer bank to a formal readiness review.
Atlanta-area firms that want a lighter first step can start with the scored Security Readiness Check for Atlanta and Georgia small businesses.
Key facts
- NIST Cybersecurity Framework 2.0 places supplier risk under the GOVERN Function's Cybersecurity Supply Chain Risk Management category (GV.SC), where GV.SC-04 requires that suppliers are known and prioritized by criticality and GV.SC-06 calls for due-diligence planning before a formal relationship begins, which is the exact function a customer's incoming questionnaire performs (NIST CSWP 29, February 26, 2024).
- The FTC Safeguards Rule at 16 CFR 314.4(f) requires a covered financial institution to select service providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess them based on the risk they present, which is why a regulated customer's questionnaire asks about exactly those three things (eCFR, current 2026).