Why do security questionnaires keep arriving, and getting longer?
Your customers are themselves answering to their customers, insurers and regulators, and supplier diligence is where their obligations become your inbox. Expect the volume and depth to rise as you sell to larger organisations, including US customers whose diligence may name SOC 2, a decision my ISO 27001 vs SOC 2 comparison covers.
This pressure is what turns questionnaires into a case for certification, as my guide for customers requiring ISO 27001 explains. The organisations that handle this well treat questionnaire answers as part of the management system.
How do you build an answer bank?
| Maintain | Source of truth |
|---|---|
| Certification status, scope, expiry, surveillance position | Certificate and certification body record |
| Policy summaries and the policy list with review dates | Controlled document register |
| Control summaries: access, change, backup, logging, encryption, vulnerability management | Statement of Applicability plus system evidence |
| Testing: penetration tests, scans, restore tests, dates and remediation stance | Test reports and corrective action tracker |
| Incident process and recent incident posture | Incident procedure and log (summarised appropriately) |
| People: screening, training completion, joiners/leavers | HR records |
| Sub-processors and significant suppliers with their assurance | Supplier register and assessments |
| Data protection: roles, locations, retention, DPA availability | Privacy documentation and contracts |
Give the bank an owner and a review date. Answers decay at the speed your systems change, and a stale confident answer is worse than a current cautious one.
How do you work through each questionnaire?
- Read what the customer actually handles of yours, and answer for that service and scope.
- Pull from the bank; tailor only what is genuinely product-specific.
- Route anything new to the control owner before it leaves the building.
- Answer gaps honestly with plan and interim measure; log the commitment as an ISMS action so you actually do it.
- File the submitted version. The next questionnaire, and the customer's audit, will be compared with it.
How do questionnaires connect to staying certified?
A maintained ISMS produces questionnaire answers as a by-product: the same risk register, evidence discipline and management review inputs. This is one of the practical reasons organisations hand the programme to an owner with standing, or to ongoing CISO support where questionnaire support is part of the service.
Because the evidence is already there, answers are fast and, more importantly, true.