GUIDES
How to answer a client security questionnaire
Your client is in scope, so now you are. How to answer honestly, once, in a way you can reuse — and why the confident lie is the expensive option.
Understand why it arrived
This is almost never about you. Your client has a supply-chain obligation under NIS2, DORA or a certification they hold, and the questionnaire is how they evidence it. That means the reviewer is looking for something they can file, not for a perfect answer.
It also means the questions are generic and many of them will not apply to what you actually do.
"Not applicable" is an answer. "Yes" without evidence is a liability.
If you do not process card data, say so and explain why the section does not apply. A reviewer accepts that far more readily than a row of confident ticks.
A yes you cannot evidence is worse than a no with a date next to it. If the control is not in place, say when it will be — "no, planned for Q1, owner named" is a credible answer and it survives the follow-up. A tick that turns out to be untrue after an incident is a contractual problem on top of a security one.
Answer once, reuse forever
The second questionnaire will ask the same things in a different order. Keep a single source document with your answers and the evidence each one points to — a policy, a screenshot, a contract clause, a test report — and fill the next form from it rather than from memory.
That document is also most of what an ISO 27001 statement of applicability wants, which is why organisations that get asked often eventually certify: it is cheaper than answering the same questions forever.
Ask what scope they mean
One clarifying question saves days: does this cover the service you buy from us, or our whole company? The answer usually narrows the form by half, and asking it reads as competence rather than evasion.
If the questionnaire asks for something you genuinely cannot meet, say so early. A supplier who flags it in week one is manageable; one who is discovered in month six is replaced.