How to answer a customer security questionnaire without guessing

A deal is moving, then the customer sends a security questionnaire. Eighty questions about MFA, backups, access reviews, and encryption. You’re the founder or the ops person who “owns IT,” and the temptation is to answer yes to everything so the deal doesn’t stall.

That’s how you get stuck later. Auditors, insurers, and the next customer will ask for proof. Here’s a better way to fill these out without inventing controls you don’t have.

What these questionnaires are for

The customer’s security team wants to know how you protect their data before they trust you with it. The form is a filter. They’re looking for real controls, clear ownership, and honest gaps, not perfect scores.

Common packets include SIG, CAIQ, and custom spreadsheets. The questions repeat more than they look like they do: access control, MFA, encryption, backups, incident response, vendors, and who leaves with access still open.

Gather evidence before you type

Don’t open the spreadsheet first. Spend thirty minutes collecting what you already have:

• Who can grant and revoke access (names, not “IT”)
• Whether MFA is required for email, VPN, admin tools, and production
• Where customer data lives (SaaS apps, cloud accounts, laptops)
• Last backup restore you actually tested, with a date
• How you offboard people the day they leave
• Who gets alerted if something looks wrong
• Any policies you actually follow (even short ones)
• Prior questionnaire answers, if you’ve filled one before

If you can’t point to evidence, the honest answer is usually “partial” or “no,” plus a one-line plan. Guessing “yes” creates a promise you’ll have to defend.

How to answer without guessing

Use three buckets for every control question:

1. Yes: you do it today, and you can show how (screenshot, config, policy, ticket, or log).
2. Partial: you do part of it, or only in some systems. Say what’s covered and what isn’t.
3. No / planned: you don’t do it yet. Give a short date or next step if you have one.

Write like a person, not a brochure. “MFA is enforced on Microsoft 365 and our VPN; production AWS still uses SSO with MFA for admins” beats “We maintain a robust multi-factor authentication program.”

When a question doesn’t apply, say so and why. “We don’t store card data; Stripe processes payments” is better than stretching PCI answers.

Build a small answer pack

The second questionnaire is faster if the first one leaves a trail. Keep a shared folder with:

• Stock answers for the questions you get every time
• Screenshots or exports that prove MFA, logging, and backups
• A one-page system map: apps, who hosts them, where data sits
• Offboarding and access-review steps you actually use
• Contact for follow-ups (one person who can answer clarifying emails)

Update the pack when something changes: a new SaaS tool, a tighter MFA rule, a failed restore test you fixed. Stale answers are almost as bad as guessed ones.

Mistakes that slow deals down

• Answering yes with no evidence ready when they ask for proof
• Copying last year’s answers after you changed tools
• One shared admin password still in use while claiming unique accounts
• Policies nobody has read, attached as if they were controls
• Waiting until the night before the deadline to start

A simple order of operations

1. Assign one owner for the packet.
2. Collect evidence for access, MFA, data location, backups, and offboarding.
3. Answer in yes / partial / no with short facts.
4. Flag gaps you’ll fix this quarter so sales isn’t blindsided.
5. Save the final answers and proof into the answer pack.

If questionnaires keep stalling deals, the problem usually isn’t the form. It’s missing controls or missing proof. Fix those once, and every later packet gets shorter.

I’ve helped small teams get through customer security reviews with clear answers and a plan for the gaps. If a packet is sitting on your desk, email [email protected].