---
title: "Customer Security Questionnaires: How to Answer"
description: "How to answer customer security questionnaires accurately and fast: build an answer bank from maintained evidence, and use certification to shorten them."
canonical: https://www.isosecurity.co.uk/resources/customer-security-questionnaires
updated: 2026-11-10
---

# Customer security questionnaires, answered from evidence

Build one maintained set of answers, drawn from your policies, evidence and certificate, owned and reviewed like any other part of the ISMS. Each questionnaire then becomes an afternoon of selection and tailoring, answered consistently every time.

## Why do security questionnaires keep arriving, and getting longer?

Your customers are themselves answering to their customers, insurers and regulators, and supplier diligence is where their obligations become your inbox. Expect the volume and depth to rise as you sell to larger organisations, including US customers whose diligence may name SOC 2, a decision my [ISO 27001 vs SOC 2 comparison](/resources/iso-27001-vs-soc-2) covers.

This pressure is what turns questionnaires into a case for certification, as my guide for [customers requiring ISO 27001](/resources/customer-requires-iso-27001) explains. The organisations that handle this well treat questionnaire answers as part of the management system.

## How do you build an answer bank?

| Maintain                                                                                 | Source of truth                                       |
| ---------------------------------------------------------------------------------------- | ----------------------------------------------------- |
| Certification status, scope, expiry, surveillance position                               | Certificate and certification body record             |
| Policy summaries and the policy list with review dates                                   | Controlled document register                          |
| Control summaries: access, change, backup, logging, encryption, vulnerability management | Statement of Applicability plus system evidence       |
| Testing: penetration tests, scans, restore tests, dates and remediation stance           | Test reports and corrective action tracker            |
| Incident process and recent incident posture                                             | Incident procedure and log (summarised appropriately) |
| People: screening, training completion, joiners/leavers                                  | HR records                                            |
| Sub-processors and significant suppliers with their assurance                            | Supplier register and assessments                     |
| Data protection: roles, locations, retention, DPA availability                           | Privacy documentation and contracts                   |

Give the bank an owner and a review date. Answers decay at the speed your systems change, and a stale confident answer is worse than a current cautious one.

## How do you work through each questionnaire?

1. Read what the customer actually handles of yours, and answer for that service and scope.
2. Pull from the bank; tailor only what is genuinely product-specific.
3. Route anything new to the control owner before it leaves the building.
4. Answer gaps honestly with plan and interim measure; log the commitment as an ISMS action so you actually do it.
5. File the submitted version. The next questionnaire, and the customer's audit, will be compared with it.

## How do questionnaires connect to staying certified?

A maintained ISMS produces questionnaire answers as a by-product: the same risk register, evidence discipline and [management review](/resources/iso-27001-management-review) inputs. This is one of the practical reasons organisations hand the programme to an [owner with standing](/resources/who-should-own-your-isms), or to ongoing [CISO support](/virtual-ciso-services) where questionnaire support is part of the service.

Because the evidence is already there, answers are fast and, more importantly, true.

## Frequently asked questions about customer security questionnaires

### Why do customers send security questionnaires?

Because they carry risk for your handling of their data and have to evidence their own supplier diligence, increasingly under their own ISO 27001, regulatory or insurance obligations. A current ISO 27001 certificate answers the majority of it in advance, which is one reason customers increasingly require the certificate itself.

### How can we answer security questionnaires faster?

Maintain the answers once, centrally, from evidence that already exists: your certificate and scope, policies, risk overview, control summaries, testing results, incident process and sub-processor list, each with an owner and a review date. Each questionnaire then becomes an exercise in selection and tailoring, while organisations rebuilding answers per customer spend days per form and contradict themselves across customers.

### What should we never do on a security questionnaire?

Claim a control, policy or certification you do not have, copy answers from another company's template, promise remediation timescales with no owner, or let sales complete technical answers unreviewed: questionnaires become contractual representations. An honest 'not yet, planned for Q3, interim measure is X' beats a confident falsehood that surfaces in the customer's first audit.

### Does ISO 27001 certification remove questionnaires entirely?

A current certificate shortens them dramatically: most enterprise diligence accepts the certificate and scope for the management-system questions and focuses the remainder on your specific service, data flows and sub-processors. Suppliers without certification should expect the full form, plus follow-up evidence requests, every time.

## Contact

Questionnaires eating your week and contradicting each other? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.