Answering a vendor security questionnaire without losing three weeks

Every new enterprise client sends their security questionnaire. The formats differ, the questions are eighty per cent the same. Treating each questionnaire as a unique project is the best way to spend three weeks per deal.

The base to prepare once

Write out, once and precisely, the answers to the eight families that recur everywhere.

Identity and access management. How accounts are created, on what basis, who approves them, how often they are reviewed, and how quickly they are revoked when someone leaves. The point auditors look at first: the revocation time, and the evidence that it is met.

Authentication. MFA mandatory or not, on which systems, with which factor. Password policy. Whether there is a central identity provider.

Encryption. In transit, with the minimum accepted TLS version. At rest, with the algorithm and key management. Who holds the keys is often the real question.

Logging and monitoring. What is logged, where, for how long, and who can read it. Whether alerts exist and whether someone handles them.

Incident management. Written procedure, named roles, client notification deadline, and — a frequent trick question — the date of the last exercise actually run.

Subcontracting. Named list of sub-processors, hosting countries, transfer instrument. Answering "none" while using a cloud host is a mistake that discredits the whole questionnaire.

Business continuity. Backups, frequency, and above all the date of the last restore test actually performed. "We have backups" does not answer the question.

People security. Confidentiality clause, reference checks at hiring, annual awareness training with attendance evidence.

Answering honestly about what you do not have

This is what separates a credible file from a suspicious one. A questionnaire answered entirely in the affirmative is a red flag to an experienced assessor: nobody has everything.

For each gap, write three things: what does not exist, the compensating measure in place, and the date by which you plan to address it. An assessor much prefers "no ISO 27001 certification, measures aligned with Annex A documented, certification targeted within eighteen months" to a ticked box that will not survive an audit.

The format that speeds everything up

Prepare a single six to eight page document, structured around the eight families above, updated every six months, with a visible version date. Send it spontaneously at the first commercial exchange, before even receiving the client's questionnaire.

The effect is twofold. You answer most of the questions before they are asked. And you signal, to a buyer comparing several providers, that the subject has been dealt with — which is a stronger differentiator than most sales arguments.