Security questionnaire help
A customer sent you a security questionnaire. Now what?
Do not start by guessing your way down the spreadsheet. First separate what your company knows, what needs verification, and what it simply does not do today.
The readiness check takes about three minutes and does not require an account.
Start here
Treat the questionnaire as a truth-gathering exercise, not a test you have to pass.
A customer is trying to understand how your business handles security. Your job is to give them an accurate picture. That may include strong answers, partial answers, unknowns, and practices you do not currently have.
Step 1
Do not answer from memory.
A questionnaire can turn a casual statement into something a customer relies on. Start by separating what you know from what you still need to verify.
Step 2
Gather what already exists.
Look for current policies, previous questionnaire answers, IT or cloud settings, vendor information, employee procedures, and evidence you are actually allowed to share. Reuse what is current instead of starting from a blank page.
Step 3
Keep different kinds of truth separate.
A written policy is not the same as a stated practice. A stated practice is not automatically an implemented control. Evidence, completed testing, and independent certification are different again.
Step 4
Say when the answer is unknown or no.
If your company does not currently perform an activity, do not relabel something else to make the answer sound stronger. If you are unsure, verify it before answering.
Step 5
Keep the approved answer for next time.
The same themes appear again and again. Once an answer has been verified and approved, keep the scope, supporting information, and review date with it so the next questionnaire does not restart the process.
Who owns the response?
One person can coordinate it without pretending to know every answer.
Route technical, people, and business questions to the person who can actually verify them.
A simple working method
Put every question into one of four buckets.
This keeps the first pass honest and tells you where to spend your time before you send anything back.
Clear
You know the current answer and can support its scope.
Scattered
The information exists, but it is spread across people, documents, or systems.
Needs verification
You think you know the answer, but someone needs to confirm it before you state it.
Not currently done
The company does not currently perform the activity. Record that accurately rather than inventing a substitute.
Questions that commonly slow people down
Understand the question before you decide how to answer it.
These are some of the areas where small businesses can accidentally overstate what they do. Each guide explains what the customer is really asking, what may support the answer, and what not to claim.
Before you send it back
Do one accuracy pass.
- Does every yes match what the company actually does today?
- Did you narrow broad questions to the systems, people, or data you can actually support?
- Did you avoid treating a written policy as proof that a control operates?
- Did you avoid claiming testing, reviews, scans, training, or certifications unless they actually occurred?
- If evidence is referenced, does that evidence really exist and is it appropriate to share?
- Did you mark anything that still needs verification before submission?
Start with what is true
See what your company could answer today before you start filling in the questionnaire.
The free Oredra readiness check shows which common areas are clear, scattered, uncertain, or simply not something your company currently does. It is not a compliance score.
Take the free readiness checkEducational guidance only. Oredra does not determine that a control, test, certification, or security practice exists unless the company information supports that statement.