Customer security questionnaires: stop starting from scratch

Why filling in the form takes more than writing

Questions can cover who can access data and how your business would recover from a security incident.

An answer describes what your business does. Evidence is the material that backs it up, such as a written process or an audit report. The buyer can ask for that material alongside the form.

We wanted to understand what this work involves for the people doing it. On 15 October 2026, we analysed 124 posts and comments across 55 Reddit and Hacker News discussions. They describe experiences of answering customer forms and reviewing suppliers.

Finding or reusing evidence appeared in 39 discussions, compared with 15 for repeating answers or formats. Teams described searching scattered documents and reusing existing reports. That gives you a useful place to start: organise the material behind your answers.

Keep that material with a library of answers you can use again. It still needs someone to look after it. One respondent owned the spreadsheet, chased specialists and checked whether old answers remained true.

Start with a recent completed questionnaire. For each answer worth reusing, keep its supporting document, the person who can check it and the date last reviewed. Use that record as the starting point for the next customer.

Give AI a clear job and a human reviewer

Teams in our study used AI tools to draft answers from their existing documents. Their experiences show why completing the questionnaire still needs a person.

An IT team checked each response its AI tool produced. Another team had an evidence library and AI help, but still entered answers into customers’ online forms and arranged human reviews. Producing a draft left those jobs to do.

A tool also needs a clear process to describe. One respondent knew how the company handled staff leaving but could find no agreed written process. Completing the form felt like inventing policy.

Waiting was a different problem again. A sales engineer described submitting answers quickly, then waiting weeks or months on the customer. Faster drafting would not address that reported wait.

Before choosing a tool or changing the process, name the work that is stuck. Use the questions below to decide what to tackle. Record time spent doing the work separately from time spent waiting for a reply.

Ask what the customer will accept

Before completing every box, find out what the buyer needs to see. Several accounts described customers accepting existing documents instead of a full new response.

A small software team was asked which AI models it used, what data they touched and how it governed their use. The team wrote its own PDF. The customer accepted it, even though the author felt the document was thin.

A different company described a document showing how its product design met its standards. It said customers usually accepted that document, with few follow-up meetings. In another account, a buyer accepted existing security reports after suppliers challenged requests they considered too large.

Other teams still completed long forms alongside their audit reports. Ask early which existing evidence the customer will accept and which questions still need a specific answer.

Start that conversation before copying answers into a new format. Agree what the review covers, offer the documents you already hold and confirm which questions still need answering.

Prepare for the customer you want to win

The practical question is what to have ready before the next customer asks. A separate UK government survey helps explain why this matters when selling to larger businesses.

In that survey, 48% of large businesses reviewed their immediate suppliers for cyber risks, compared with 12% of micro businesses. These are checks on firms they buy from directly. Supplier checks were more common among larger firms.

This separate survey covered 2,112 UK businesses between August and December 2025. Its results were weighted to represent the business population. These figures measure formal reviews of supplier cyber risks.

Build a pack of checked answers and supporting documents from your next completed review. Keep what the customer accepted and note questions that needed a new decision. Then assign someone to keep it current for the next request.

Take a recent questionnaire to your next team meeting. Use the table below to agree what belongs in that pack. Name who checks the answers, updates the documents and follows up with the customer.

How we did the research

The Assurance Desk analysed the material on 15 October 2026. We combined stored records, a focused Reddit collection, Hacker News searches and public-page readings. The study covers posts published from 15 October 2024 to 15 October 2026. We screened for the topic, then read relevant posts and comments for concrete first-hand experiences.

The sample contains 22 opening posts and 102 comments from 118 public accounts, across 48 Reddit and 7 Hacker News discussions. We removed duplicate captures. Each discussion counts once per theme, and themes overlap. Evidence mentions include successful reuse as well as difficulty finding proof.

This is an international discussion study, mainly from software and security communities. It is not a representative survey of businesses. Accounts and outcomes were not independently verified. Public handles do not establish a count of people or companies. The findings identify experiences and practical questions, not UK prevalence, typical completion times or savings caused by a tool.

Searches were limited and did not recover every comment. Reddit keyword discovery covered the past year within the longer study window. The same AI analyst screened and re-read the material, without an independent human review. Removing Reddit leaves 7 discussions; removing discussions with flagged vendor-mention accounts leaves 50. Full methods, theme counts and these checks are in the data download.

These quotations were checked against saved readings of public posts, which may not show later edits. They are public accounts, not interviews or expert endorsements.