How do you answer a security questionnaire?

Buyers send security questionnaires because they carry the risk of their suppliers. Several laws make that due diligence an obligation. NIS2 lists supply chain security among the measures in Article 21(2)(d). DORA requires financial entities to manage ICT third-party risk and to assess providers before contracting (Article 28). The GDPR lets a controller use only processors that provide sufficient guarantees (Article 28(1)). The questionnaire is how the buyer collects that evidence.

The format varies. Some buyers use standard questionnaires such as the Cloud Security Alliance CAIQ or the Shared Assessments SIG. Many send their own spreadsheet or a Word or PDF document.

• Keep one library of what you may disclose: policies, implemented controls, certifications, KPIs and the hosting providers and subprocessors you use, each with an owner.
• Answer in the buyer’s file. Keep their structure and question references so their reviewer can check your answers against their list.
• Draft each answer from that library only, and cite the document or control it rests on.
• Be honest about gaps. A clear “not in place” with a plan is better than an answer that claims a control you have not implemented.
• Review before sending. Look first at answers that claim compliance while the cited control is not implemented or the cited policy is still a draft.
• Save approved answers for reuse, with a review date so they do not go stale.

• Copying answers from the last questionnaire without checking they are still true.
• Answering yes to a control described in a draft policy.
• Pasting answers into a new template instead of the buyer’s file, which forces their reviewer to map them back.
• Sending confidential documents without an NDA or a record of who received them.

The Trust Center imports the prospect’s questionnaire as Excel, CSV, Word or PDF, and recognises a CAIQ v4 workbook. It first resolves the facts that apply from your Exposure Library and Answers Library, then Aiko phrases an answer from those facts alone, showing what each draft was built from. An answer with nothing behind it is marked Gap, and an answer that asserts compliance while the cited control is not implemented gets a warning. Approved answers are written back into a copy of the original spreadsheet. See the Trust Center.