Security Questionnaire: How a Small Company Answers Its First One

A security questionnaire is the list of questions a customer sends before buying from you, asking how you protect their data, who approved your security policies, whether your staff have read them and what happens when something goes wrong. For a small or growing company the first one usually arrives with a deal attached, and how you answer it decides whether the deal moves or stalls, which is why it sits at the center of our guide to compliance for small and growing businesses.

This guide is for the founder, operations lead or engineer who has just been handed a spreadsheet of a hundred questions and a deadline. It covers what the questionnaire asks, which documents buyers want, how to answer honestly when you don’t have every control in place yet, and how to make sure the second questionnaire takes a fraction of the time the first one did.

Key takeaways

• A security questionnaire tests your written policies as much as your technology, so the policies you can send, with approval dates and acknowledgment records, carry most of the weight.
• Answer honestly, with dates: a clear “not yet” and a plan keeps a deal moving, while an optimistic “yes” becomes a contract promise.
• Split the questionnaire by owner, answer from your current policies rather than from memory, and have one person read every answer before it goes out.
• Save every answer in a library tied to the policy and version it describes, and update it whenever that policy changes or comes up for review.

What is a security questionnaire?

A security questionnaire, sometimes called a vendor security questionnaire or a vendor risk assessment, is how a customer checks that a supplier won’t become their weakest link. Their security or procurement team asks the same questions of every supplier who will touch their data or systems, scores the answers, and decides whether to approve you, approve you with conditions, or ask for more.

Some customers write their own, usually as a spreadsheet, while many use a standard format. The ones you are most likely to meet are the Standardized Information Gathering questionnaire (SIG) and its shorter SIG Lite from Shared Assessments, the Consensus Assessments Initiative Questionnaire (CAIQ) from the Cloud Security Alliance for cloud services, the free VSA-Full and VSA-Core questionnaires from the Vendor Security Alliance, and, if you sell to colleges and universities, EDUCAUSE’s HECVAT. They range from a few dozen questions to well over two hundred, and the longer ones often let you skip whole sections that don’t apply.

Sources: sharedassessments.org, cloudsecurityalliance.org, vendorsecurityalliance.org, educause.edu

Why a growing company gets its first questionnaire

The first questionnaire usually arrives at the moment a company starts selling to bigger customers. A mid-sized buyer has its own auditors, insurers and regulators asking how it manages its suppliers, so its procurement process won’t sign a contract until your answers are on file, however much its team likes your product.

That makes the questionnaire a sales document as much as a security one. It is also a test of whether you have written down how you work, because nearly every section asks the same three things in different words: is there a written policy, who approved it, and do the people it applies to know about it.

What a security questionnaire asks, and who should answer

Whatever the format, most questionnaires share the same sections. At a company of 20 to 200 people each one usually has a natural owner, and splitting the work that way on day one is the quickest route to answers that are accurate.

The first section is the one most small companies underestimate. It is rarely technical, but it sets the tone for everything after it, because a buyer who sees an approved, recently reviewed security policy that every employee has acknowledged reads the rest of your answers with more trust.

The documents buyers ask you to send

Most questionnaires ask you to attach documents as well as answer questions, and the same handful come up again and again. If you have these written, approved and current, you can answer most of any questionnaire.

• Information security policy: the umbrella document that says how security is run, who owns it and how often it is reviewed.
• Acceptable use policy: what staff may do with company devices, accounts and data.
• Access control policy: how access is granted, reviewed and removed, including when someone leaves.
• Incident response plan: how you detect, handle and tell customers about a security incident.
• Business continuity and disaster recovery plan: backups, recovery and how the plan is tested.
• Vendor management policy and subprocessor list: who else touches customer data and how you check them.
• Data classification and retention policy: what you treat as sensitive and how long you keep it.
• Privacy policy: usually the public one already on your website.
• Training and acknowledgment records: proof that staff were told about the policies above.
• Any report or certificate you hold: a SOC 2 report, an ISO 27001 certificate or a recent penetration test summary.

Behind almost every document sits the same follow-up: when was it approved, by whom, when is it next reviewed, and how do you know employees have read it. Those are governance questions rather than security ones, and our guide to policy governance covers how a growing company sets them up once instead of rebuilding them for every questionnaire.

How to answer a security questionnaire, step by step

Years of responding to RFPs taught me to read every question line by line before answering any of them, because a questionnaire answer often ends up referenced in the contract, and a promise you can’t keep later turns into a breach. These steps keep the first questionnaire accurate and make the next one faster.

1. Ask before you start. Confirm the deadline, the format and who will read the answers, and ask whether the buyer will accept something you already have, such as a SOC 2 report, an earlier completed standard questionnaire or a security overview, in place of some or all of the questions.

2. Read it end to end, then split it. Mark each section with its owner, mark the questions that don’t apply to you so you can say so briefly, and put one person in charge of the deadline.

3. Answer from your policies, not from memory. Every answer about how you work should match what your current, approved policy says. If the policy and the practice disagree, fix one of them before you answer, because the buyer may ask for the document later.

4. Answer honestly, with dates. A question has three honest answers: yes, partly, or not yet. Each should be specific, so “yes” names the evidence, “partly” says what exists and what doesn’t, and “not yet” gives a plan and a date.

5. Attach evidence with care. Send what answers the question and no more, use an NDA for internal documents, and prefer a summary over raw exports where a summary does the job, such as an acknowledgment summary rather than a list of every employee.

6. Have one person read everything. Different owners write in different ways, and the reviewer’s job is to catch answers that contradict each other or promise more than the policies say.

7. Save every answer. Before the questionnaire goes out, copy each answer into your answer library with the policy and version it relies on, so the work you just did is never done twice.

Answering honestly before you have SOC 2

Most small companies get their first questionnaires long before they have a SOC 2 report or an ISO 27001 certificate, and that is normal. Buyers know a 30-person company won’t have the same program as a 3,000-person one, and what they are really judging is whether you are honest, whether the basics are written down and whether you know where your gaps are.

So say what you have, because approved policies, a named owner, acknowledgment records and a dated plan for the gaps make a credible answer, and a buyer can approve you with a condition, such as a follow-up review in six months, far more easily than they can approve an answer they later find was overstated. Remember too that SOC 2 is an attestation report from an independent CPA firm rather than a certification, so avoid wording like “SOC 2 certified” in any answer, and our guide to SOC 2 policies for a small company covers what that report will expect when you get there.

Prove your policies were approved and read

When we delivered services to one of the largest healthcare companies in the world, our people couldn’t start work on the account until they had signed that client’s policies and we could show the proof. A security questionnaire asks the same question in writing, and the answer is only as good as the record behind it.

In AllyMatter that record builds itself as you work. Each policy goes through its approval workflow before anyone can see it, so the approval date and the approvers are on file. It then goes to the people it applies to for acknowledgment, the record shows each person, the version and the time, and Document Analytics shows each person’s request status. If a customer asks your staff to acknowledge the customer’s own policy, you can upload it as a PDF and get it acknowledged by name the same way.

Build an answer library that stays current

The second questionnaire should take a fraction of the time the first one did, but only if your answers are still true. Answer libraries go stale quietly, because a policy changes and nobody updates the twelve answers that quoted it, so the library has to be tied to the policies themselves.

Two habits make this work. Record the policy name and version next to every answer, and give the policy owner the job of checking those answers whenever the policy changes or comes up for review. In AllyMatter each policy carries a review date, either fixed or repeating, and version compare shows every word removed and added between versions, so the owner can see in minutes which answers a change affects.

Publish what you are happy to share

Many questionnaires can be shortened before they start. A short public security overview, your privacy policy and your subprocessor list answer a surprising number of first questions, and buyers increasingly look for them before they send anything at all.

In AllyMatter any approved policy can be set to Public, which gives it a page anyone with the link can read, while drafts and internal procedures stay inside your workspace. Only an approved version can be public, so what a prospect reads is always the version in force, and switching the setting back takes the page down at once.

When to stop answering one by one

Answering questionnaires one at a time works for the first few deals. It stops working when several deals a quarter wait on security review, when buyers start asking for a SOC 2 report rather than answers, or when enterprise customers make a report a condition of signing, and that is usually the point at which a SOC 2 report or ISO 27001 certification starts to pay for itself.

The policies come first either way. A security automation tool such as Vanta or Drata collects technical evidence from your cloud accounts and devices, while a policy center like AllyMatter runs the policies, approvals, acknowledgments and reviews that sit beside that evidence, and our sister site, Policy and Compliance, explains what each standard asks for. Our guides to annual policy attestation and building a compliance program cover the next steps once questionnaires become routine.

Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.

Questions about security questionnaires

What is a security questionnaire?

A security questionnaire is a list of questions a customer sends to a supplier to judge how well the supplier protects the customer’s data, covering policies, access, incidents, continuity, vendors and people. It is usually part of procurement, and the answers often feed into the contract.

How long does it take to answer a security questionnaire?

A first questionnaire often takes days, because the answers have to be found, written and checked for the first time. Once you keep an answer library tied to your current policies, most of the next one can be answered from the library and only the new questions need real work.

Can we send our SOC 2 report instead of answering the questionnaire?

Often, yes. Many buyers accept a SOC 2 report or an ISO 27001 certificate in place of all or part of their questionnaire, so it is always worth asking, but they may still send a shorter set of questions about anything the report doesn’t cover.

What should we do if we don’t have a policy the questionnaire asks for?

Say so plainly, then say what you do in practice and when the written policy will be in place. A truthful “not yet” with a date is far safer than a “yes” that becomes a promise in the contract.

Who should answer a security questionnaire at a small company?

One person should own the response and its deadline, usually a founder or the person who owns your policies, while each section goes to whoever runs that area, such as engineering for access and incidents and HR for background checks and training. One reviewer then reads the whole thing before it goes out.

Should we share our internal policies with a prospect?

Share what answers the question and no more. Many companies send policies under an NDA, or publish a short security overview and a privacy policy openly, while keeping detailed procedures and architecture diagrams for customers who have signed.

A security questionnaire rewards the company that wrote down how it works before anyone asked. Get the policies approved, get them in front of the right people, keep the record, and the questionnaire stops being a fire drill and becomes a form you fill in from what you already have.

Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.