Customer security questionnaires: what they ask and how to answer

What do customer security questionnaires ask?

They ask about responsibilities, access, data protection, testing and recovery. The National Cyber Security Centre, or NCSC, covers these areas in its supplier guidance. The table turns them into checks for the person preparing a response.

The records below are examples to consider, not a compulsory attachment list. The customer should judge the evidence needed against the service's importance and risk.

How should you answer each question?

Describe what is in place for the service being reviewed. Check what the question covers before answering for the whole business. A policy can describe an intended practice without showing that people follow it.

Where a requirement is only partly met, explain the boundary. Where it is not met, identify the gap and the work proposed. The NCSC recommends recording unmet controls, actions and timescales in a security management plan. A control is simply a measure used to manage a risk.

For example, a recovery plan and a tested recovery process are different things. If the plan exists but testing is outstanding, make that distinction clear in the response.

If a question seems irrelevant, ask the customer to confirm its scope. Explain why it does not apply to the service. If the answer is unknown, obtain confirmation from the person responsible before stating that the requirement is met.

The customer may be willing to work with a supplier whilst gaps are addressed. That is a discussion about its requirements and the available timescale, rather than an outcome to assume.

Who should own the questionnaire?

Give the response a coordinator and involve the people responsible for the underlying work. The NCSC recommends bringing IT, business, procurement and cyber security teams together for supplier assurance.

A useful division is for the coordinator to track questions and evidence, whilst the relevant owner confirms each answer. Use named responsibilities to resolve uncertainty about a policy or practice.

Does certification replace a security questionnaire?

Certification only answers questions within its scope. Ask the customer what it will accept. The NCSC names Cyber Essentials, Cyber Essentials Plus and ISO27001 among certifications customers may consider. Check that the certificate covers the service and its intended use.

Accreditation checks whether a body is competent and impartial to carry out work such as certification. UKAS CertCheck provides a free way to verify UKAS-accredited management systems certification.

A certificate and answers about the specific service address different questions. The NCSC cautions that compliance with a standard does not, by itself, establish security.

How should you share supporting evidence?

Agree how sensitive evidence will be handled before sending it. The NCSC recommends clarifying how supplier information will be used and who will have access. It also says these records need secure storage.

For a sensitive report, ask which parts the reviewer needs and how access will be controlled. Check whether an appropriate summary will meet the request. The level of evidence should reflect the risk, whilst commercially sensitive information still needs protection.

Confidentiality arrangements do not remove a processor's obligation to demonstrate compliance with UK data protection law. The UK data protection regulator, the ICO, explains that relevant contract terms must provide for information, audits and inspections.

How can you prepare for the next questionnaire?

Keep approved answers with their supporting records, scope and review date. The NCSC describes supplier assurance as a view at a point in time, so both answers and evidence need updating.

Use the records to track who can answer a follow-up, what remains outstanding and when it will be reviewed. The NCSC's mapping guidance includes assurance contacts, assessment dates, open actions and certification evidence.

Recheck an earlier answer before reusing it for another customer. Confirm that the service and evidence still match the new question.

A complete answer and a partial answer

What to do

1. Confirm the service and information the questionnaire covers.
2. Bring each answer together with its evidence and responsible person.
3. Agree how to explain outstanding work and share sensitive records.

Common questions

Is a completed questionnaire enough for UK data protection law?

A questionnaire does not replace the required processor contract or other binding legal act. When a business processes personal data on a customer's behalf as its processor, UK law requires that arrangement in writing. The ICO sets out required terms covering security, further processors, the end of processing and audits.

Can you use an AI-drafted questionnaire answer?

Check the evidence before approving any automatically drafted answer. The same question applies: does it describe what this service actually does? Keep responsibility with the relevant person and protect any sensitive material used in preparing the response.

Where next

• What does ISO 27001 certification take, and who can certify you?
• How much is Cyber Essentials, and what does it ask?
• What is supplier assurance, and what do buyers check?
• How do you answer a security questionnaire without a certificate?

This is an independent editorial guide, not legal advice.