In short
Security questionnaires stem from supplier risk assessment, which NIS2 and the GDPR often make necessary for your customers.
Questions from different customers largely overlap: that is why a reusable answer library makes sense.
ISO 27001 Annex A works as an index: every question links to a control, with an approved answer and its evidence.
An explained "no", with a compensating control or a plan, is more credible than a "yes" you cannot prove.
An ISO 27001 certificate does not eliminate questionnaires, but it shortens them and makes answers ready and verifiable.
A security questionnaire can hold up a contract for weeks. It almost always arrives at the same moment: the deal is agreed, the customer's procurement team needs to qualify the supplier, and they send you a file with dozens or hundreds of questions about passwords, backups, incidents, suppliers and personal data. You pass it to your IT manager, who fills it in one evening, answering from memory. A month later another customer arrives with another file, and it all starts again.
Answering customer security questionnaires does not have to be a one-off craft job you repeat every time. With an answer library built on ISO 27001 controls, you do it once and reuse it for every customer. In this guide we look at what these questionnaires really ask, why they arrive more and more often, how to use the structure of ISO/IEC 27001 Annex A to organise your answers, which evidence to attach, how to handle awkward questions and which mistakes to avoid. You will also find a question-to-control mapping table to start from.
What is a security questionnaire and why do customers send you one?
A security questionnaire is the tool a customer uses to assess the risk you pose as a supplier. Before entrusting you with data, access to its systems or a critical service, it wants to know how you protect information. The format varies (spreadsheet, online portal, form attached to the contract), but the logic is always that of supplier risk assessment: understanding whether, by working with you, the customer inherits a vulnerability.
What a questionnaire usually contains
Almost every questionnaire revolves around the same areas, even when the questions are worded differently. There are governance questions (is there a security policy? who is responsible for it?), questions about people (training, confidentiality agreements, leavers), access (multi-factor authentication, administrator accounts), continuity (backups, recovery, emergency plans), incidents (how you detect them, how quickly you notify the customer) and your own suppliers, that is, the chain that sits behind you.
A software company with 40 employees may receive, in the same quarter, a questionnaire from a bank, one from a utility and one from a healthcare provider. The questions largely overlap: the order, the wording and the level of detail change. It is precisely this overlap that makes an approach other than "fill in and forget" possible.
Why questionnaires arrive more and more often
Customers do not send questionnaires out of curiosity: they are often required to. The NIS2 Directive requires essential and important entities to adopt risk management measures that include supply chain security, including security-related aspects of their relationships with direct suppliers (Article 21(2)(d)). When assessing those measures, they must take into account the vulnerabilities specific to each supplier and the quality of its cybersecurity practices (Article 21(3)). The link between the directive and a management system is explained on our NIS2 page.
The GDPR pushes in the same direction. A controller may only use processors that provide sufficient guarantees on technical and organisational measures (Article 28(1)), and the contract must require the processor to make available the necessary information and allow for audits, including inspections (Article 28(3)(h)). A questionnaire is the simplest way to collect that information.
ENISA, the European Union Agency for Cybersecurity, captured this trend in its report Good Practices for Supply Chain Cybersecurity (2023), based on a 2022 ENISA survey: 61% of the organisations surveyed require a security certification from suppliers and only 9% say they do not evaluate their suppliers in any way. For a supplier, in practice, the questionnaire is no longer an exception but a normal stage of the sale.
Why is filling in every questionnaire from scratch a mistake?
Answering from scratch looks like the quickest route, but it has costs that surface later. The first is time: every questionnaire takes hours away from whoever manages IT or quality, almost always the same two or three people. The second, more dangerous, is inconsistency between answers: if you tell one customer that backups are tested every month and another that they are tested "periodically", you have created two versions of the truth.
Answers become contractual commitments
Many customers attach the completed questionnaire to the contract or refer to it in the security clauses. What you write therefore becomes a verifiable commitment, which the customer can check with an audit or challenge after an incident. An optimistic answer given to close the paperwork quickly ("yes, we encrypt all data") can become a serious problem if it later turns out that an archive was not encrypted.
Knowledge stays in one person's head
When answers live in the emails of whoever wrote them, the company depends on that person. If they change jobs or are on holiday at the wrong moment, the next questionnaire starts from zero. The description of your security measures is a company asset: it should sit in one place, up to date and accessible to those who need it, not scattered across files with names like "questionnaire_final_v3".
How does ISO 27001 help you answer security questionnaires?
ISO/IEC 27001 gives you the structure that a set of improvised answers lacks. The standard sets out the requirements for an information security management system: rules, roles and controls chosen on the basis of risk and kept under control over time. The standard itself notes that it can be used by internal and external parties to assess the organisation's ability to meet its own information security requirements: exactly what a customer does with a questionnaire. For the full picture, start with our complete guide to ISO 27001.
Annex A as an index for your answers
Annex A of ISO/IEC 27001:2022 is a reference list of information security controls. According to ISO, the 2022 revision details 93 controls grouped into four themes: organisational, people, physical and technological. The numbering is the same as in ISO/IEC 27002:2022, the standard that provides guidance on implementing them: for example, 5.15 is access control, controls 5.19 to 5.23 cover suppliers and cloud services, 6.3 covers awareness and training, and 8.8 the management of technical vulnerabilities.
This structure works like an index. Almost every question in a questionnaire, however it is worded, maps to a reference control. Instead of filing "the answer to customer X's questionnaire", you file the answer to the control, and reuse it from there for everyone.
Statement of Applicability and certificate scope
Not every control applies to every company. In an ISO 27001 system the company documents which controls it applies and why, and justifies those it excludes: this is the Statement of Applicability. For questionnaires it is a valuable document, because it forces you to already have a clear position on every area. If you have no server room because you only use cloud services, the answer to questions about the physical security of your data centre is already written, with its justification.
The same goes for the certification scope. The certificate covers a precise scope (sites, processes, services): when you answer a customer, check that the service you provide falls within that scope. Stating "we are ISO 27001 certified" for a service outside the scope is a mistake an attentive customer will spot immediately.
How to build an answer library based on ISO 27001 controls
An answer library is a repository in which every control has an approved answer, an owner and linked evidence. You build it once, starting from the questionnaires you have already received, and update it when something changes. The method works in four steps.
Step 1: collect the questionnaires and normalise the questions
Gather your most recent completed questionnaires and bring them together in a single sheet. You will find that many questions are the same question written in different ways: "do you use MFA?", "is two-factor authentication enabled for remote access?", "how do you protect administrator accounts?". Group them by topic and rewrite them in a neutral form. From a few hundred rows you will end up with a much shorter list of unique questions, which becomes the basis of the library.
Step 2: link every question to a control
Match each unique question to the closest Annex A control. The table shows some typical pairings; control titles are summarised, using the ISO/IEC 27002:2022 numbering.
Typical customer question | Reference control | Evidence to keep ready |
|---|---|---|
Is there a security policy approved by management? | 5.1 Policies for information security | Signed policy, date of last review |
Is multi-factor authentication enabled? | 5.15 Access control; 8.5 Secure authentication | Access procedure, configuration extract |
How do you assess critical suppliers? | 5.19–5.22 Information security in supplier relationships | List of critical suppliers, assessment criteria |
Do you use cloud services? With what guarantees? | 5.23 Information security for use of cloud services | List of services, provider attestations |
Are staff trained in security? | 6.3 Awareness, education and training | Training plan, attendance records |
How do you manage vulnerabilities? | 8.8 Management of technical vulnerabilities | Patching procedure, test summary |
How quickly will you notify us of an incident? | 5.24–5.26 Incident management | Incident procedure, notification times |
Step 3: write every answer on three levels
A good library answer has three layers. The first is the short answer: yes, no or partially, because many portals ask for nothing more. The second is a two- or three-sentence description that works for any customer: what you do, how often, who is responsible. The third is the reference to the evidence, meaning the document or record that proves what you have written.
An example for multi-factor authentication: "Yes. Multi-factor authentication is mandatory for email, remote access and administrator accounts, as required by the access control procedure. Exceptions are authorised by the security manager and reviewed every six months. Evidence: access procedure, configuration extract." It is precise, verifiable and promises nothing beyond the truth.
Step 4: assign an owner and a review date
Every answer needs an owner (IT, HR, quality, legal) and a date of last review. When a supplier, procedure or tool changes, the owner updates the linked answer. Including the library review in the management review stops it from becoming an obsolete archive: it is already the moment when you look at risks, objectives and changes, as we explain in our guide to the ISO management review.
With Complaion this work is supported by the platform: management system documents and evidence are gathered in one place and the compliance calendar reminds you of reviews and renewals. Your dedicated Lead Auditor helps you link every requirement to the right controls, so when a questionnaire arrives, answers and proof are already where they need to be.
What evidence should you attach to a security questionnaire?
Evidence is what turns a statement into proof. An experienced customer is not satisfied with a "yes": it asks for the policy, the certificate, a procedure extract, sometimes a test report. Preparing it in advance, in a version designed for external use, saves you the longest part of every questionnaire.
What you can share safely
Some documents you can always keep ready in a folder for customers: the ISO 27001 certificate with its scope, the information security policy, a summary of technical and organisational measures, the list of sub-supplier categories, a note on incident management and notification times. If you have carried out an independent security test, such as a web application penetration test, you can share a summary letter confirming that it took place and how findings were handled, without handing over the full report.
If you have not done the test yet, Complaion also carries out WAPT, web application penetration testing: the report gives you the basis for a summary to share with customers.
What never to send
Some information should not be attached to a questionnaire, even if the customer asks for it: detailed network diagrams, firewall configurations, lists of IP addresses, exact versions of installed software, reports of unresolved vulnerabilities. This is exactly the information an attacker needs, and the questionnaire travels through inboxes and portals you do not control. If the customer has a genuine need, offer a review by video call or on site, or sharing protected by a confidentiality agreement.
How do you answer when the answer is "no"?
No company has every control in place, and the customer knows it. A well-handled "no" is more credible than a fragile "yes". The rule is simple: never lie, and never leave the answer without an explanation.
You have three options. If the control is not applicable, explain why, consistently with your Statement of Applicability: "We do not operate our own data centres; services run on the infrastructure of a cloud provider certified to ISO/IEC 27001". If the control is missing but an alternative measure exists, describe the compensating control: for example, an unencrypted archive that only two administrators can access, with strong authentication and logged access. If the control is missing and needed, state the plan: what you will do, by when and who is responsible.
An IT consultancy SME, for example, receives a question about a formal business continuity plan it does not yet have. Instead of answering "yes" or leaving the field blank, it writes that backup and recovery are tested and documented, that the plan is being prepared, and states the quarter in which it will be completed. The customer sees a supplier aware of its own gaps, which is exactly what a risk assessment wants to find. If this applies to you, read our guide to the business continuity plan for SMEs.
Every recurring "no" is also information for you. If three customers out of five ask for the same thing, that gap belongs in your risk treatment plan. This way questionnaires stop being just a cost and become a market signal about where to invest.
Does an ISO 27001 certificate replace questionnaires?
No, but it greatly reduces their weight. The certificate shows that an accredited, independent certification body has audited your management system against the standard, within a defined scope. Faced with a valid certificate, many customers shorten the questionnaire or limit themselves to questions specific to their case.
What the certificate does not tell
The certificate attests that the management system conforms to the standard; it does not describe in detail how you have implemented each control. The customer may have its own needs: tighter incident notification times, data stored in a certain country, requirements specific to its sector. That is why you will keep receiving questions. The difference is that the answers already exist, because the management system has led you to define, document and verify them.
How to present your certification in the questionnaire
Attach the certificate and state the exact scope, the expiry date and the body that issued it, so the customer can check its validity. Explain in one line which services fall within the scope and, if the service the customer is buying is covered, say so explicitly. Remember too that the certificate stays alive through surveillance audits: if one is coming up, you can mention it as a further assurance, without anticipating its outcome.
What are the most common mistakes in security questionnaires?
The most frequent mistakes are not technical: they come from haste and from the lack of a method. These are the six we see most often in the companies we work with.
Answering "yes" by default, counting on nobody checking: answers can end up in the contract and the customer can request an audit.
Having one person fill in everything without involving HR, legal or whoever manages suppliers: many questions are not technical.
Using vague wording such as "we adopt industry best practices", which an assessor reads as a missing answer.
Copying answers from an old questionnaire without checking them, while tools and suppliers have changed.
Claiming certification for services that fall outside the certificate scope.
Attaching internal documents not designed for external use, containing sensitive technical data.
If you do not yet have a management system, the first step is to get the basics in order. The minimum cybersecurity measures for SMEs cover a large share of the questions you will find in any questionnaire and are the natural starting point for your future answer library.
How Complaion helps you answer security questionnaires
With Complaion you build the ISO 27001 management system that sits behind a good answer library. A dedicated Lead Auditor works with your company, helps you define the scope, assess risks and choose Annex A controls, and proposes the path that best fits your needs, including when other standards or NIS2 and GDPR compliance are required. The platform collects evidence, manages documents, keeps the compliance calendar and prepares the audit: everything you need to answer a customer is already organised and up to date. For questions on personal data, you can also rely on our outsourced DPO service.
More than 1,000 clients have already chosen Complaion to get certified and keep their certification over time. If you receive questionnaires more and more often and want to stop starting from zero, discover the path to ISO 27001 certification or contact us for a quote: we will help you understand where to start, based on your customers and your organisation.
Frequently asked questions about customer security questionnaires
Do I have to answer a customer's security questionnaire?
There is no general legal obligation for the supplier, but it is often a condition for signing or renewing the contract. Many customers, especially those subject to NIS2 or that entrust you with personal data as controllers, must assess the security of their suppliers. Refusing usually means dropping out of the selection. You can, however, negotiate the format, offering your certificate and a summary of your measures instead of a full questionnaire.
How long does it take to build an answer library?
It depends on how many questionnaires you have already completed and how well documented your security system is. If you already have an ISO 27001 management system, much of the work consists of reorganising existing answers and evidence. If you are starting from scratch, the library grows together with the management system. Either way, it pays to start from the most recent questionnaires, which reflect your customers' real requests.
Do I need ISO 27001 certification to use this method?
No. You can use the Annex A structure as an index even without certification, because it is an international reference that assessors know. Certification, however, adds independent verification, which many customers explicitly ask for. Organising your answers around ISO 27001 controls from the start also makes it easier to get certified later.
What should I do if the customer asks for confidential documents?
Assess whether the request is proportionate to the service you provide. For sensitive documents, offer sharing protected by a confidentiality agreement, a review by video call or an on-site check. Never email technical configurations, network diagrams or reports of open vulnerabilities. A summary designed for external use almost always meets the customer's need.
How often should the answer library be updated?
Whenever something relevant changes: a critical supplier, a tool, a procedure, the certificate scope. On top of that, it is worth reviewing it periodically together with the management system, for example during the management review. A date of last review on every answer tells you immediately what to check before sending a questionnaire.
Is the security questionnaire the same for NIS2 and GDPR?
Customers often combine the two needs in a single questionnaire, but the aim is different. NIS2-related questions concern supply chain security and service continuity. GDPR-related questions check the guarantees the processor provides for personal data. A library based on ISO 27001 covers a large part of both, and control 5.34 on privacy and protection of personal data helps you answer the specific questions.
Who should fill in the questionnaire in the company?
You need a coordinator, usually the security or quality manager, who collects the answers and ensures they are consistent. Individual answers, however, should be validated by whoever actually runs that area: IT for access, HR for training, procurement for suppliers, legal for contracts. With a shared library, the coordinator assembles the questionnaire and involves the others only on new questions.
