How to respond to a customer security questionnaire

Confirm the service and the decision

A customer questionnaire often arrives through sales with a deadline and little context. Before filling it in, identify the service being purchased, the information it will handle, and the person requesting the review. An answer about your internal office systems may not describe the service the customer will use. Ask whether the questionnaire concerns the entire business, one product, or a specific supplier relationship.

Record the response deadline and the customer contact who can explain ambiguous requirements. If the customer requests a SOC 2 report, confirm which report they need and why. Do not replace a requested independent report with a self-assessment or imply that readiness work supplies the same assurance. You may need to discuss an alternative evidence package, but the customer decides whether it is acceptable.

Build a small evidence register

For each question, record the responsible role, the evidence reference, when it was checked, and any uncertainty. Keep the actual records in an approved private location. A policy shows what is intended; a configuration record or completed review may show what is implemented. Neither should be described as stronger evidence than it is. Use a limited, redacted example when that is sufficient and permitted.

A practical register can begin with five columns: customer question, proposed answer, evidence reference, owner, and unresolved issue. Group related questions about access, recovery, suppliers, and incident handling so the relevant people can review them together. A sales owner can coordinate the response without guessing technical answers. The security assessment scope builder can help turn unanswered questions into a defined review.

Answer within the evidence

Use the vocabulary of the question, but explain important boundaries. A yes about multifactor authentication should state which system and which users it covers if the questionnaire allows supporting notes. Do not turn a partial deployment into a universal claim. When only yes or no is available, ask the customer how to represent a partial control or attach a clarification through their approved process.

Fictional example: a small agency requires multifactor authentication for its main email service but has not confirmed the settings of a separate billing application. A defensible answer identifies the verified email requirement and the unresolved billing question. The next step is a configuration review by the application owner. This example is a reasoning exercise, not a description of a CyberWiz client or a completed assessment.

Separate a gap from a promise

A planned improvement is not an implemented control. Record its owner, dependencies, and proposed completion date separately from the current answer. Before sharing a date externally, confirm that the person with authority has accepted the work and that the responsible team can support it. Avoid filling a sales deadline with commitments that operations has never reviewed.

Some questions ask about contractual obligations, insurance, or regulatory requirements. Route those to the responsible business, legal, or insurance adviser. This workflow does not interpret those obligations for you. A security consultant can help explain technical evidence and organize gaps, while the authorized business owner decides what the organization will represent to the customer.

Review, send securely, and keep a dated copy

Have the appropriate owners review the response and the attachments before the authorized sender submits them. Check that private documents are approved for disclosure, links have the intended access restrictions, and attachments do not reveal unnecessary system details. Use the customer-approved exchange method. Do not put credentials, raw customer records, or confidential diagrams into an introductory email or a public website worksheet.

Keep a dated copy of the final answers and their evidence references. When the next questionnaire arrives, use that copy as a starting point rather than as proof that nothing has changed. Recheck affected answers after a system migration, provider change, or material control update. If recurring requests keep exposing unassigned security work, consider whether ongoing security leadership would make the response process more reliable.

Sources and further reading

• NIST: cybersecurity supply chain risk management

This field note is general educational guidance. Your organization’s requirements, scope, and service arrangements determine the work that applies.